Before the firewall: built on trust
In the 1980s SS7 linked a closed club of operators with no authentication — if a message arrived, it was delivered. As A2P boomed (mostly through grey routes), spam, spoofing and grey traffic went straight through. Three triggers created the modern firewall: lost A2P revenue · SS7 security holes · spam and spoofing. Today there are ~2 trillion A2P SMS a year, and grey routes are down to ~23% (from ~100% in 2010).
What an SMS firewall is
It inspects every message in real time and decides: Pass · Block · Flag · Quarantine. It works on rules and pattern detection — no human reads the messages.
Two layers
- SS7 layer — protects the mobile network (unauthorized location queries, spoofed network messages). Covered in the SS7 session.
- SMPP / A2P layer — protects our traffic and revenue (inspects message submissions, catches fraud on our routes). This is the day-to-day focus.
How traffic reaches the firewall (example topology)
A client (e.g. Twilio) → the platform (FAAST, SMPP) → SMSC/STP where SMPP ends and SS7 starts → signalling providers (Comfone, Tata, BICS) → the Cellusys firewall inside the MNO, which runs a whitelist check per partner → termination to the subscriber. SMPP faces applications; SS7 carries it onward.
Why it matters
- Revenue — AIT means paying for traffic nobody wanted.
- Operator relationships — abusive traffic can get an interconnect suspended.
- Client trust — sender IDs protected, campaigns kept clean.
- Regulation — markets expect fraud controls, not just reports.
Key terms
| Term | Meaning |
|---|---|
| A2P / P2P | business→person / person→person |
| Sender ID | the name or number the recipient sees |
| SMPP | the protocol clients use to submit SMS |
| AIT | Artificially Inflated Traffic — fake traffic made only to earn fees |
| Grey route | delivery outside the official agreement |
| SIM farm | many SIMs sending A2P as if it were P2P |
| Smishing | SMS phishing, usually with a fake sender |
The three patterns behind most tickets
- Sender ID spoofing — pretend to be a trusted brand. Some routes don't validate the sender ID; the firewall checks a per-client allowed list, guards sensitive IDs (banks, government), and blocks unregistered IDs.
- AIT (Artificially Inflated Traffic) — a fraudster earns a fee per message on a route, bots trigger real OTP requests that terminate on that route, and the business pays. "Looks like normal OTP traffic — the fraud is in the why, not the how." Firewall checks: volume/velocity spikes, route anomalies, same number many OTPs.
- Grey routes — A2P sent at P2P prices (often via a SIM farm). Operators lose A2P revenue and see odd load; we risk penalties and route suspension. The firewall spots bulk disguised as P2P.
SIM farms in A2P
Hundreds of ordinary SIMs make A2P look like P2P. Signs: changing mobile numbers instead of a sender ID; far more SMS per SIM than any person sends; the same text from many SIMs; unstable delivery as SIMs get blocked. Impact: operator loses A2P revenue, the brand loses its sender ID and trust, OTPs arrive late or not at all.
SS7 example — IMSI disclosure
A fake SMSC sends SRI-SM + the victim's number to a gateway STP; the home HLR answers with IMSI + serving MSC/VLR + HLR address. The attacker needs only SS7 access and the victim's phone number, and gets the IMSI and node addresses — used next for location tracking and man-in-the-middle on calls/SMS. Firewall rule: answer SRI-SM only for known SMSCs; SMS Home Routing hides the real IMSI behind a proxy.
Firewall rules (illustrative, not real thresholds)
| Rule | What it checks | Example | Action |
|---|---|---|---|
| Sender ID | whitelist of approved IDs/partners, per-market registration | "MYBANK" from a route not allowed to use it | BLOCK |
| Content | known phishing links and fraud text | a fake bank login link | BLOCK |
| Volume & velocity | sudden spikes from one source or to one destination | OTPs to one country jump 10× in an hour | QUARANTINE |
| Behaviour | the same number requesting many OTPs | one number gets 20 OTPs in 5 min | BLOCK |
| Routes | unusual traffic concentration on one route | one route suddenly carries most traffic to a country | FLAG |
| SIM farm / P2P pattern | bulk disguised as P2P | one SIM sends the same text to 2,000 numbers | BLOCK |
Every entry into the MNO passes a whitelist; an unregistered sender ID is the most common block. Rules are tuned internally and never explained to clients.
How the firewall responds
- PASS — clean traffic goes through.
- BLOCK — clear violation, stopped before delivery.
- FLAG — suspicious but not certain; marked and logged.
- QUARANTINE — held until reviewed, then passed or blocked.
Remember this (Module 5): The firewall is the checkpoint SS7 never had. It inspects every message by rules (no human reads them) and decides Pass/Block/Flag/Quarantine. Two layers: SS7 (protect the network) and SMPP/A2P (protect revenue). The three big fraud patterns are sender-ID spoofing, AIT and grey routes — behind almost all of them is money. The most common block is an unregistered sender ID.