Why signalling exists: in-band → out-of-band
The old telephone network was in-band: control tones shared the voice line. Three problems: - Speed — tones are slow; long-distance call setup took seconds. - Waste — a full voice line was reserved even while ringing. - Security — the control was just a sound, so anyone who could play the right tone controlled the switch.
The famous story: international calls used Signalling System No. 5 ("Atlantic Code"), with tones at 2400 Hz and 2600 Hz; 2600 Hz meant "line free". A toy whistle from Cap'n Crunch cereal produced exactly 2600 Hz — hence the hacker "Captain Crunch". People built blue boxes to play the tones and make free calls (Steve Wozniak built them too; his is in the Computer History Museum).
The fix was out-of-band (common channel) signalling: control moves to a separate data network. The voice circuit is reserved only when needed, and customers can no longer inject tones. This enabled fast call setup, roaming, SMS, prepaid and number portability.
Where are SS1–SS6?
Numbers 1–5 were older, in-band, analogue systems (SS5 = the Atlantic Code). SS6 (1970s) was the first with a separate signalling channel — the out-of-band idea was already there — but it was built for the analogue world and never spread widely. SS7 took the idea and built it properly: digital, fast, and in layers, so new parts (like MAP for mobile) could be added. There is no SS8; successors got new names (Diameter, HTTP/2).
Four decades of SS7
- 1980s — CCITT (now ITU-T) defines SS7 to control calls between switches (fixed networks). Used by a few big national telcos who all trusted each other — remember this for security.
- 1990s — GSM adds MAP (Mobile Application Part): roaming, SIM authentication, SMS.
- 2000s — SIGTRAN: the same SS7 messages move from TDM links onto IP networks. The messages stayed the same; only the transport changed.
Who is connected to SS7 (a closed club → a global network)
Then: a few national telcos, trust was natural. Now: thousands of companies — - Mobile operators — run the HLRs, MSCs, SMSCs. - International carriers / signalling providers — carry signalling between countries. - Roaming hubs and IPX — one connection reaches hundreds of partners; IPX is the private IP network they use. - Fixed and virtual operators (MVNOs) — MVNOs sell service using another operator's radio network. - SMS hubs and A2P providers — route SMS and HLR lookups (this is us). - Global Title renters — companies that rent an SS7 address from an operator.
Every member can send messages to every other member — and SS7 trusts all of them. GT leasing became such a problem that the GSMA published a Global Title Leasing Code of Conduct (GSMA FS.52, later extended to Diameter end-point addresses) and the UK regulator Ofcom moved to ban GT leasing outright.
A day in the life of a phone (SS7 does much more than SMS)
| Time | Event | What SS7 does | Nodes |
|---|---|---|---|
| 08:00 | Switch on | checks SIM, notes location | VLR → HLR |
| 09:30 | Land in Italy | foreign network tells your operator you're there | VLR (IT) → HLR (HR) |
| 12:00 | Call a friend | two exchanges agree to connect | MSC ↔ MSC (MAP finds, ISUP connects) |
| 12:01 | Prepaid call runs | network checks balance mid-call | MSC → SCP (CAP) |
| 15:00 | Dial *100# | USSD balance check | MSC → HLR |
| 18:00 | Receive an SMS | SMSC stores, asks HLR, delivers | SMSC → HLR → MSC |
Only SMS needs an extra node (the SMSC) because a message must wait if the phone is off. The MSC handles both calls and SMS.
SS7 today, next to 4G and 5G
| 2G/3G | 4G | 5G | |
|---|---|---|---|
| Signalling | SS7 | Diameter | HTTP/2 (web services) |
| Subscriber DB | HLR | HSS | UDM |
| Security between operators | none (trusts everyone) | possible, rarely used | built in (SEPP at the border) |
They run side by side: one subscriber database, three doors. The weakest door is SS7 — and because 2G/3G and international SMS still cross it, SS7 security still matters.
If you know the internet, you know SS7
| Internet | SS7 |
|---|---|
| Router | STP |
| Private IP address | Point code |
| Public IP address | Global Title |
| Port (80, 443) | SSN (6, 7, 8) |
| TCP | MTP2 / SCTP |
| The internet (network of networks) | SS7 (network of operator networks) |
The big difference is trust: on the internet, servers check who is talking (passwords, certificates). In SS7, a message is trusted simply because it arrived.
Remember this (Module 3): SS7 moved control out of the voice channel (out-of-band) to fix speed, waste and the blue-box security hole. It is digital and layered, so MAP (mobile) and SIGTRAN (over IP) could be added. It grew from a trusted club into a global network of thousands, but kept the "trust everyone inside" rule — which is the root of its security problems. 4G/5G are more secure but run alongside SS7, so SS7 is still the weak door.