Signaling in the telephone networks

Authors: Danilo Tomassi, Sandro Pileri

1
Training for TIM Celular Rio de Janeiro

Network Signaling Systems

A Telecommunication Network Signaling System is an essential component that provides a mechanism for network switches to exchange routing, link status, and connection control information In-Band Signaling
network signals share the same physical channel as the call being set up and are carried within the user 300-3400 Hz voiceband

Out-of-Band Signaling
signaling messages are carried outside of the users voiceband

Common Channel Signaling (CCS)

one type of out-of-band signaling designed to exchange signaling information between digital switching systems using signaling channels that are separate from the users voice channel

2
Training for TIM Celular Rio de Janeiro

Signaling in the Telephone Networks

SS7 signaling Switching System
IT16

Switching System

23 086

363 9

086 23

08 3 62 36 0 39

9 363 0

3
Training for TIM Celular Rio de Janeiro

Signaling System N. 7 (SS7)

SS7 provides two types of services: circuit-related and noncircuitrelated services. Circuit related signaling is used for the setup and teardown of voice connections. Noncircuit-related services are all of the other services provided by the network, such as database access (translations, subscriber information,) and network management. This signaling system has been standardised by the CCITT (International Telegraph and Telephone Consultative Committee), after known as ITU (International Telecommunication Union), and with national standards (i.e. ANSI - American National Standard Institute ed ETSI - European Telecommunication Standard Institute).

4
Training for TIM Celular Rio de Janeiro

Signaling System N. 7 (SS7)

SS7 is a CCS ITU-T standard designed to support both voice and nonvoice services SS7 is optimized for message-oriented signaling, using digital trunks operating at speeds up to 64 kbit/s
Circuit switch
1 2

Circuit switch
1 2

Phone channels
N
Msg.Transf.

N
Msg.Transf.

Processor CCS7 signaling messages

5

Processor

CCS7 circuit (64 Kb/s)

Training for TIM Celular Rio de Janeiro

CCS Network N. 7
Switching Systems

SP
Phone Channels

SP

SP

STP

STP

Signaling Network
Signaling message SP=Signaling Point SP STP=Signal Transfer Point STP 6

STP

STP
Training for TIM Celular Rio de Janeiro

Signaling System N. 7 (SS7)

SS7 uses transmission channel of 64 Kbit/s (one or more) to communicate with database of the network in order to realize advanced telecommunication networks and to offer advanced services:
Supplementary services (call transfer, call holding, malicious call identification, multi party service); Intelligent network services (free numbers, local number portability, premium services, ...) Wireless networks (GSM, UMTS, )

7
Training for TIM Celular Rio de Janeiro

SS7 applications
HLR

SS7 for call control and supplementary services

MSC MSC

MSC

SS7 for data base

interrogation

SCP

MSC

8
Training for TIM Celular Rio de Janeiro

SS7 - OSI Comparison (1)

OSI Levels 7 6 5 4 3 2 1
9
Training for TIM Celular Rio de Janeiro

OSI
Application Presentation Session Transport SCCP Network TCAP

SS7

I S U P

T U P

MTP Level 3 Data Link Physical MTP Level 2 MTP Level 1

MTP (Message Transfer Part)

MTP (Message Transfer Part) is responsible of the correct transfer of signalling information. MTP transfers information without losses, duplicates or errors, respecting the sequence of the messages. It is divided into three levels. The techniques of recognition and correction errors allow to have the following values:
Probability to not recognize errors < 10-10 with: Loss of messages due to routing errors or other causes < 107 Delivery of out-of-sequence messages < 10-10 .

10
Training for TIM Celular Rio de Janeiro

User Part (UP)

The main UPs are:
TUP (Telephone User Part): TUP, now obsolete, was used to set up and tear down analogue circuits used for voice calls; ISUP (ISDN User Part): is used to set up and tear down all circuits used for data or voice calls in the Public Switched Telephone Network (PSTN) or in wireless networks (GSM); Provides basic and supplementary services; It is now widely used throughout the world.

11
Training for TIM Celular Rio de Janeiro

Signaling Connection Control Part (SCCP)

SCCP is a (layer) protocol used for accessing databases within the network (non-circuit related) ITU, ANSI, and Telcordia standards provide procedures for ISUP services over SCCP, but this has not yet been implemented.

12
Training for TIM Celular Rio de Janeiro

Transaction Capabilities Application Part (TCAP)

TCAP is designed for non-circuit related messages, such as data base interrogation. These messages are destined for database entities as well as actual end office switches. The TCAP protocol provides a means for the reliable transfer of information from one application at a switch location to another application within another network entity. The first usage of the TCAP protocol was 800 number translation.
13
Training for TIM Celular Rio de Janeiro

ISDN User-to-network signaling

Recommendation Q.931 is not a part of SS7 but specifies a user-to-network signaling protocol, called DSS1, to set up, hold on, and tear down ISDN connections. It is aimed at supporting ISDN supplementary services as well. Recommendation Q.921 specifies a data link protocol, called LAP-D, which provides both connection oriented and connectionless service to the upper layer. Some functions provided by this layer are:
Error detection and recovery Multiplexing/demultiplexing Flow control
14
Training for TIM Celular Rio de Janeiro

Q.931 (layer 3) (call handling)

LAP-D (layer 2) Physical (layer 1)

The LAP-D frame

bit 8 7 6 5 4 3 2 1

Ottetto 4 5 4 5 4

INFORMATION X X X

N(S) N(R)

0 P S S 0 1 P/F M 1 1

SUPERVISORY UNNUMBERED

X N(R)

This field allows to provide connection oriented or connectionless services

P/F M

Layer 3 information FLAG 01111110 ADDRESS CONTROL INFORMATION FCS FLAG 01111110

bit 8 7 6 5 4 3 2 1

SA PI T EI
15

C /R

0 1

This field allows mux/demux over the D-channel

This field allows error detection

Training for TIM Celular Rio de Janeiro

The Digital Subscriber Signaling n.1

01111110

ADDRESS

CONTROL

INFORMATION

FCS

01111110

Setup Setup ack Call proceeding Alerting Connect Connect ack Progress Information Disconnect Release Release Complete Status Status Enquiry Restart Restart Ack Notify Register Resume Resume Ack Suspend Suspend Ack Resume reject Suspend reject

bit 8 7 6 5 4 3 2 1

Protocol discriminator Call Reference Message type Other information elements

N information elements

16
Training for TIM Celular Rio de Janeiro

Interworking DSS1-ISUP

ISDN TE (TE1)

DSS1
SE

Local switch

SS7

SETUP
2B+D D channel

TU

IAM
64 kb/s channel (TS16)

PSTN ISDN

17
Training for TIM Celular Rio de Janeiro

ISDN complete call

LE TR TR LE

18
Training for TIM Celular Rio de Janeiro

The italian PSTN: the old architecture

ISC =International Switching Centre

ISC

ISC

SGT SGT SGU SGU SGU SGU SGU

SGT

SGT SGU

19

GATEWAY AREA

GATEWAY AREA for TIM Celular Rio de Janeiro Training

The italian PSTN: the new architecture

ISC =International Switching Centre PoP = Point of Presence BBN = Telecom Italia National Backbone

ISC

ISC PoP BBN IP backbone

SGU SGU SGU SGU SGU

SGU

20
Training for TIM Celular Rio de Janeiro

Some details about SS7: network architecture

SP

STP

STP SP

SP

STP

STP

SP: Signaling Point (MSC, VLR, HLR, SCP, ) STP: Signaling Transfer Point
21

Voice (CIC) SS7 link

Training for TIM Celular Rio de Janeiro

Some details about SS7: SPs and STPs

SS7 is a data packet-switched network; The network elements are identified as SP (Signalling Point) and STP (Signaling Transfer Point) and are addressed by using a 14-bit Point Code: OPC: Originating Point Code DPC: Destination Point Code The STP routes SS7 messages as received from the various SPs through the network to their appropriate destinations (it acts like a router for signaling messages). The STP can perform the Global Title Translation and serves as a firewall to filter other signaling network messages; SPs are network element where reside the users (applications) of the signaling messages (like they were the host of an IP network)
22
Training for TIM Celular Rio de Janeiro

Some details about SS7: quad architecture

When two pairs of STP are connected in all the possible ways, the group composed of the crossed 4 links is defined quad. Every STP of one pair has a link toward the STP of the other pair. In this way the fault of a link or the out-of-service of an STP does not cause the block of the traffic. Quad architecture SP

STP

STP

SP
23

STP

STP
Training for TIM Celular Rio de Janeiro

Some details about SS7: signaling modes

Associated and quasi-associated signaling SP SP
STP STP

SP SP

ASSOCIATED

NON - ASSOCIATED

SP
STP
24

SP

QUASI - ASSOCIATED

Signalling Voice
Training for TIM Celular Rio de Janeiro

Some details about SS7: MTP level 1

MTP Level 1 defines the physical, electrical and functional characteristics of the signalling link. The physical level of MTP allows for the use of any digital-type interface supporting the data rate required by the networks. Common interfaces in most SS7 networks today include:
E-1 (2048 kb/s; 32 channels of 64 kb/s); DS-1 (1544 kb/s; 24 channels of 64 kb/s); V.35 (64 kb/s); DS-0 (64 kb/s); DS-0A (56 kb/s).

PCM
25

TX RX
Training for TIM Celular Rio de Janeiro

Some details about SS7: MTP level 1

Signalling can be transmitted on any Time Slot, not necessary on TS n. 16; Signalling is transmitted only when necessary (improvement of transmission capacity); Signalling on one channel can transport messages related to a lot of voice channels (best efficiency), as shown below:
PCM 1: TS 1..15 and 17..31: voice; TS 16:signalling; PCM 2: TS 1..31: voice; PCM 3: TS 1..31: voice; PCM 4: TS 1..31: voice; PCM 5: TS 1..31: voice;
26
Training for TIM Celular Rio de Janeiro

Some details about SS7: MTP level 2

Level 2 of MTP provides error detection/correction as well as error checking through the check bit field; the purpose is to ensure that the transmission facility is always functioning and capable of transmitting data. Is specified in :
ITU-T Q.703; ANSI T1.111;

The functions of the MTP level 2 are:

Signal unit delimitation Signal unit alignment Signal unit error detection Signal unit error correction Signaling link initial alignment Signaling link error monitoring Flow control.
27
Training for TIM Celular Rio de Janeiro

Some details about SS7: signaling unit

8 7 1 7 1 6 2 16 8

FISU

Flag BSN BIB FSN FIB LI Spare CRC Flag

8 or16 16

LSSU

Flag BSN BIB FSN FIB LI Spare Status CRC Flag

8
SIO

8n
SIF

16

MSU
28

Flag BSN BIB FSN FIB LI Spare

CRC Flag

Training for TIM Celular Rio de Janeiro

Some details about SS7: MSU acknowledge

The transmitting unit stores the MSU sent until the reception of an acknowledge from the receiving unit.

SP MSU MSU BSN=2 MSU MSU MSU BSN=5 MSU

29

SP FSN=1 FSN=2 MSU FSN=3 FSN=4 FSN=5 MSU FSN=6

Training for TIM Celular Rio de Janeiro

Some details about SS7: MSU error correction

SP MSU FIB=0 FSN=70 BIB=0 BSN=17 MSU FIB=0 FSN=71 BIB=0 BSN=17 MSU FIB=0 FSN=72 BIB=0 BSN=17 BSN=70 BIB=1 FSN=18 FIB=0 MSU MSU FIB=1 FSN=71 BIB=0 BSN=18 MSU FIB=1 FSN=72 BIB=0 BSN=18 MSU FIB=1 FSN=73 BIB=0 BSN=18 BSN=73 BIB=1 FSN=18 FIB=0 FISU MSU FIB=1 FSN=74 BIB=0 BSN=18 MSU FIB=1 FSN=75 BIB=0 BSN=18
30
Training for TIM Celular Rio de Janeiro

SP

Some details about SS7: error rate monitoring

The purpose of the Signal Unit Error Rate Monitor is to determine when an excessive number of errors have occurred (64) and take the link OOS:

Error OK / 256

6 BIT counter UP DOWN ALLARM

The SUERM is an incremental counter that is incremented by 1 whenever an error is encountered. After 256 signal units have been received without error, the SUERM is decremented by 1 (LEAKY BUCKET).
31
Training for TIM Celular Rio de Janeiro

Some details about SS7: MTP layer 3

Level 3 of MTP has two categories of functionality :
Message Routing (Signalling Message Handling) composed of:
Message Discrimination; Message Distribution;

Signalling Network Management, divided in:

Traffic Management; Link Management; Routing Management; Congestion Flow Control.

32
Training for TIM Celular Rio de Janeiro

Some details about SS7: message routing

Received message is for this SP? Y N Has the SP functionality of STP? N Y Message Discrimination: - Routing to other SP
33
Training for TIM Celular Rio de Janeiro

Message Distribution to UP

Addressing error

Some details about SS7: MTP3 fields

8 7 1 7 1 6 2 8
SIO

8n
SIF

16

MSU

Flag BSN BIB FSN FIB LI Spare L2

CRC Flag

L3 and upper

L2

SIO

SIF

SI NI
34

DPC OPC SLC / SLS CIC Signalling information Routing Label

L4 and upper
Training for TIM Celular Rio de Janeiro

Some details about SS7: service indicator (SI)

Information
Signalling-network management messages (SNM) Signalling-network testing and maintenance messages (SNT) Spare Signalling connection control part (SCCP) Telephone user part (TUP) ISDN user part (ISUP) Data user part (call and circuit-related messages) Data user part (facility registration and cancellation messages) MTP testing user part
35
Training for TIM Celular Rio de Janeiro

BIT
0000 0001 0010 0011 0100 0101 0110 0111 1000

Some details about SS7: network indicator (NI)

Information
International network Spare National network Reserved for national use

BIT
00XX 01XX 10XX 11XX

36
Training for TIM Celular Rio de Janeiro

Some details about SS7: OPC and DPC

The SPs and STPs are addressed by using a 14-bit Point Code called Signaling Point Code (SPC) A signaling message has a source address called OPC (Originating Point Code) and a destination address called Destination Point Code (DPC) OPC and DPC play a role equivalent to that of the IP address in the IP networks SPCs can be National or International A signaling element which has to be reachable from foreign signaling networks, must have both National and International Signaling Point Code (ISPC) A national SPC has a format valid inside a country, whereas an ISPC has a standardised format

37
Training for TIM Celular Rio de Janeiro

Some details about SS7: international PCs

Most significant bit

A B C D E F G H I J K L M N
Point code Area code Zone code

0 4

1 0 0 1

1 0 1 0 0 44

0 1 2

binary decimal

38
Training for TIM Celular Rio de Janeiro

Some details about SS7: message routing

(ISUP MESSAGE) OPC=28; DPC=44 CIC=4; SLS=3 STP
SPC 51

STP
SPC 24

SLS 3 CIC 4

SLS 2

SPC 28

SPC 44

CIC 12 SPC 106

Signaling Speech
39

OPC=44; DPC=106 CIC=12; SLS=2 (ISUP MESSAGE)

Training for TIM Celular Rio de Janeiro

Some details about SS7: User Part

The main UPs are: TUP (Telephone User Part): TUP, now obsolete, was used to set up and tear down analogue circuits used for voice calls; ISUP (ISDN User Part): is used to set up and tear down all circuits used for data or voice calls in the Public Switched Telephone Network (PSTN) or in wireless networks; Provides basic and supplementary services; It is now widely used throughout the world.

40
Training for TIM Celular Rio de Janeiro

Some details about SS7: ISUP message (1)

41
Training for TIM Celular Rio de Janeiro

Some details about SS7: ISUP message (2)

Type
ACM ANM BLA BLO CCR CFN CGB CGBA CGU CGUA CMC CMR CMRJ CON CPG
42
Training for TIM Celular Rio de Janeiro

Hex
6 9 15 13 11 2F 18 1A 19 1B 1D 1C 1E 7 2C

Message
Address Complete Answer Blocking Acknowledgement Blocking Continuity Check Request Confusion Circuit Group Blocking Circuit Group Blocking Acknowledgement Circuit Group Unblocking Circuit Group Unblocking Acknowledgement Call Modification Completed Call Modification Request Call Modification Reject Connect COT 05 Continuity Call Progress

Some details about SS7: ISUP message (3)

Type
CQM CQR CRG DRS FAA FAR FOT FRJ GRA GRS IAM INF INR LPA OLM

Hex
2A 2B 31 27 20 21 8 1F 17 29 1 4 3 24 30

Message
Circuit Group Query Circuit Group Query Response Charge information Delayed Release Facility Accepted Facility Request Forward Transfer Facility Reject Circuit Group Reset Acknowledgement Circuit Group Reset Initial Address Message Information Information Request Loop Back Acknowledgement Overload
Training for TIM Celular Rio de Janeiro

43

Some details about SS7: ISUP message (4)

Type
PAM REL RES RLC RSC SAM SUS UBA UBL UCIC USR

Hex
28 0C 0E 10 12 2 0D 16 14 2E 2D

Message
Pass Along Release Resume Release Complete Reset Circuit Subsequent Address Message Suspend Unblocking Acknowledgement Unblocking Unequipped Circuit Identification Code User to User Information

44
Training for TIM Celular Rio de Janeiro

Some details about SS7: ISUP call setup and release

STP
1a-IAM 4a-REL
2b-ACM 3b-ANM 5b-RLC

STP
1b-IAM 4b-REL

2a-ACM 3a-ANM 5a-RLC

IAM ACM ANM REL RLC

SP

SP

45

SS7 link Voice Circuit

Training for TIM Celular Rio de Janeiro

Some details about SS7: SCCP messages (1)

SCCP is a protocol aimed at introducing new addressing schemes within the network ITU, ANSI, and Telcordia standards provide procedures for ISUP services over SCCP, but this has not yet been implemented; SCCP is divided into five classes of service, or protocol classes:
class 0 (connectionless) when is not important the message sequence (different SL for following messages); class 1 (connectionless) when is important the sequence of messages (same SL); class 2 (connection oriented); class 3 (connection oriented): with error recovery and flow control.
46
Training for TIM Celular Rio de Janeiro

Some details about SS7: SCCP messages (2)

The SCCP uses DPC and SSN (subsystem number) to route to the appropriate network location and to the appropriate database which can be accessed at that location; Another addressing mechanism is available to SCCP users: Global Title Translation (GTT). When using the global title translation feature, messages from a service switching point (SSP) are routed to an STP, which must then translate the SCCP address fields into the point code/subsystem number combination.

47
Training for TIM Celular Rio de Janeiro

Some details about SS7: SCCP messages (3)

OPC=48; DPC= 44 Called PA: HLR GT (SCCP MESSAGE)

STP
SPC 71

GTT
SCCP

STP
SPC 37

SCCP SPC 48 MSC

STP
SPC 44

SCCP SPC 126 HLR

GTT(GT

DPC, SSN)

DPC=126; SSN=HLR
48
Training for TIM Celular Rio de Janeiro

Some details about SS7: TCAP messages

The Transaction Capabilities Application Part (TCAP) is designed for non-circuit related messages. These messages are destineted for database entities as well as actual end office switches. The TCAP protocol provides a means for the reliable transfer of information from one application at a switch location to another application within another network entity. The first usage of the TCAP protocol was 800 number translation.

49
Training for TIM Celular Rio de Janeiro