1. Introduction to Signaling

The term signaling is used in many contexts. In technical systems, it very often refers to the control of different procedures. With reference to telephony, signaling means the transfer of information and the instructions relevant to control and monitor telephony connections.

Today’s global telecom networks are included in very complex technical systems. Naturally, a system of this type requires extensive signaling, both internally in different nodes (for example, exchanges) and externally between different types of network nodes. In this document we will focus on external signaling. Thus, the term signaling in the following chapters always refers to external signaling traffic.

The main purpose of using signaling in modern telecom networks – where different network nodes must cooperate and communicate with each other – is to enable transfer of control information between nodes in connection with:

- Traffic control procedures as set-up, supervision, and release of telecommunication connections and services.

- Database communication, for example, database queries concerning specific services, roaming in cellular networks, dialog.

- Network management procedures, for example, blocking or deblocking trunks.

Traditionally, external signaling has been divided into two basic types:

- Access signaling (for example, Subscriber Loop Signaling). This means signaling between a subscriber terminal (telephone) and the local exchange.

- Trunk signaling (that is, Inter-Exchange Signaling)

This is used for signaling between exchanges.

Figure 1. Signaling in Telecommunication Networks.

1.1. Access signaling

There are many types of access signaling, for example, PSTN analog subscriber line signaling, ISDN Digital Subscriber Signaling System (DSS1), and signaling between the MS and the network in the GSM system.

Signaling on the analog subscriber line between a telephony subscriber and the Local Exchange (LE) is performed by means of on/off hook signals, dialed digits, information tones (dial tone, busy tone, etc.), recorded announcements, and ringing signals.

The dialed digits can be sent in two different ways: as decadic pulses (used for old-type rotary-dial telephones), or as a combination of two tones (used for modern pushbutton telephones). The latter system is known as the Dual Tone Multi Frequency (DTMF).

The information tones (dial tone, ringing tone, busy tone, etc.) are audio signals used to keep the calling party (the A-subscriber) informed about what is going on in the network during the set-up of a call.

Digital Subscriber Signaling System No. 1 (DSS1) is the standard access signaling system used in ISDN. It is also called a D-channel signaling system.

D-channel signaling is defined for digital access lines only. The signaling protocols are based on the OSI (Open System Interconnection) reference model, layers 1 to 3. Consequently, the signaling messages are transferred as data packets between the user terminal and the local exchange.

Due to the much more complex service environment at the ISDN user’s site, the amount of signaling information and the number of variations differ greatly from the arrangement used for the ordinary telephone subscriber signaling, described above. This fact is reflected in the number of parameters included in D-channel messages.

1.2. Trunk Signaling

The Inter-exchange Signaling information is usually transported on one of the time slots in a PCM link, either in association with the speech channel or independently. There are two commonly used methods for Inter Exchange Signaling:

- Channel Associated Signaling (CAS) In CAS, the speech channel (in-band), or a channel closely associated with a speech channel (out-band), is used for signaling.

- Common Channel Signaling (CCS) In this case a dedicated channel, completely separate from the speech channel, is used for signaling. Due to the high capacity, one signaling channel in CCS can serve a large number of speech channels. CCITT Signaling System No. 7 (SS7) is used in the Mobile Core Network. SS7 is a Common Channel Signaling system. The general concepts of both CAS and CCS are briefly described in the following sections.

1.2.1. Channel Associated Signaling (CAS)

Channel Associated Signaling (CAS) means that the signaling is always sent on the same connection (PCM link) as the traffic. The signaling is associated with the traffic channel. In a 2 Mbps PCM link, 30 time slots are used for speech, whereas TS 0 is used for synchronization and TS 16 is used for the line signaling. All 30 traffic connections share TS 16 in a multiframe consisting of 16 consecutive frames. On TS 16, each traffic channel has a permanently allocated recurring location for line signaling, where two traffic channels share TS 16 in one frame. However, register signaling is carried over the traffic channel.

- Line Signals Line Signals are used during the whole duration of a call to monitor the status of the connection and traffic circuit. Example: Seizure, Answer signals.

- Register Signals The Register Signals are used during the set-up phase of a call to transfer address and category information. Example: dialed B-number.

As previously mentioned, the register signals are only used during call set-up, hence the information B-number, charging, dialog. CAS uses code sender and code receiver for Register Signals. These devices are released after the call set-up.

The line signals are used for seizing the trunk during the call set-up as well as releasing the trunk at the termination of the call, which can be initiated either by the A subscriber (Clear Forward) or the B subscriber (Clear Back).

1.2.2. Common Channel Signaling (CCS)

In CCS, signaling messages (or data packets) are transmitted over time slots in a PCM link reserved for the purpose of signaling, instead of Line Signals and Register Signals (which do not exist in CCS). The system is designed to use a common data channel (or signaling link) as the carrier of all signals, required by a large number of traffic channels.

2. Signaling System 7 (SS7)

2.1. Introduction

Comité Consultatif International Télégraphique et Téléphonique (CCITT, now ITU-T, International Telecommunication Union, Telecommunications sector) has defined interfaces and methods for digital communication, used world wide. The Signaling System No. 7 (SS7) is an elaborate set of recommendations defining protocols for the internal management of digital networks. These recommendations were introduced in 1980 and revised in 1984 and 1988 in different-colored books (yellow, red, and blue).

CCITT SS No. 7 is intended primarily for digital networks, both national and international, where the high transmission rates (64 kbps) can be exploited. It may also be used on analog lines especially on international trunks (CCITT SS No 6).

CCS was initially meant for telephony only, but has now evolved into non-telephony and non-connection related applications (for example, location updating of a mobile subscriber). A dialog with a database or between two databases is a typical application for CCS in the Mobile Core Network.

Thus, there is a need for a generic system that is able to support a wide variety of applications in telecommunication. The variety of applications is increasing as new types of telephony systems and a wider use of databases in the network become necessary (mobile telephony networks, ISDN, IN, etc.).

Even though the standardization of SS7 is now the responsibility of ITU-T, for traditional and historical reasons, the system is often called “CCITT No. 7 signaling system”.

The signaling system used in GSM and WCDMA systems follows the CCITT recommendations: the modular layer structure allows flexible usage of the specifications.

The interfaces between different levels and the protocols of the functions in each layer are defined in CCITT SS No.7.

Protocol is a set of definitions and agreements on how to communicate.

The communication between functions always takes place on the same level according to the protocol for that level. Only functions on the same level can “understand” each other.

In CCITT Signaling System (SS) No. 7 the control messages are exchanged between different nodes. These control messages are used by the relevant nodes for call management purposes, for example, set-up, maintenance, termination, etc. In reality the signals are data packets, hence, SS7 is a type of packet switching system. SS No.7 only defines the functions of various levels, but does not dictate the details of implementation.

Other standards than those specified by ITU-T are in use today. The SS7 network in the USA, for instance, is based on the ANSI (American National Standards Institute) standard. In some situations, the differences between these standards may cause interfacing problems in the SS7 network.

2.2. SS7 Network Architecture

Figure 2. General SS7 architecture.

SS7 can employ different types of signaling network structures. The choice between these different structures can be influenced by factors such as administrative aspects and the structure of the telecommunication network to be served by the signaling system.

The worldwide signaling network has two functionally independent levels:

- International

- National

This structure makes possible a clear division of responsibility for signaling network management. It also lets numbering plans of SS7 nodes belonging to the international network and the different national networks be independent of one another.

SS7 network nodes are called signaling points (SPs). Each SP is addressed by an integer called a point code (PC). The international network uses a 14-bit PC. The national networks also use a 14-bit PCexcept North America and China, which use an incompatible 24-bit PC, and Japan, which uses a 16-bit PC. The national PC is unique only within a particular operator's national network. International PCs are unique only within the international network. Other operator networks (if they exist) within a country also could have the same PC and also might share the same PC as that used on the international network. Therefore, additional routing information is provided so that the PC can be interpreted correctly that is, as an international network, as its own national network, or as another operator's national network.

2.2.1. Signaling Links and Linksets

SPs are connected to each other by signaling links over which signaling takes place. The bandwidth of a signaling link is normally 64 kilobits per second (kbps). Because of legacy reasons, however, some links in North America might have an effective rate of 56 kbps. In recent years, high-speed links have been introduced that use an entire 1.544 Mbps T1 carrier for signaling. Links are typically engineered to carry only 25 to 40 percent of their capacity so that in case of a failure, one link can carry the load of two.

To provide more bandwidth and/or for redundancy, up to 16 links between two SPs can be used. Links between two SPs are logically grouped for administrative and load-sharing reasons. A logical group of links between two SP is called a linkset.

Figure 3. Signaling link and Signaling linkset

A number of linksets that may be used to reach a particular destination can be grouped logically to form a combined linkset. For each combined linkset that an individual linkset is a member of, it may be assigned different priority levels relative to other linksets in each combined linkset.

A group of links within a linkset that have the same characteristics (data rate, terrestrial/satellite, and so on) are called a link group. Normally the links in a linkset have the same characteristics, so the term link group can be synonymous with linkset.

2.2.2. Routes and Routesets

SS7 routes are statically provisioned at each SP. There are no mechanisms for route discovery. A route is defined as a pre-provisioned path between source and destination for a particular relation.

All the pre-provisioned routes to a particular SP destination are called the routeset.

2.2.3. Node Types

There are three different types of SP (that is, SS7 node):

- Signal Transfer Point

- Service Switching Point

- Service Control Point

Signal Transfer Point

A Signal Transfer Point (STP) is responsible for the transfer of SS7 messages between other SS7 nodes, acting somewhat like a router in an IP network.

An STP is neither the ultimate source nor the destination for most signaling messages. Generally, messages are received on one signaling link and are transferred out another. The only messages that are not simply transferred are related to network management and global title translation.STPs route each incoming message to an outgoing signaling link based on routing information contained in the SS7 message. Additionally, standalone STPs often can screen SS7 messages, acting as a firewall.

An STP can exist in one of two forms:

- Standalone STP

- Integrated STP (SP with STP)

Standalone STPs are normally deployed in "mated" pairs for the purposes of redundancy. Under normal operation, the mated pair shares the load. If one of the STPs fails or isolation occurs because of signaling link failure, the other STP takes the full load until the problem with its mate has been rectified.

Integrated STPs combine the functionality of an SSP and an STP. They are both the source and destination for MTP user traffic. They also can transfer incoming messages to other nodes.

Service Switching Point

A Service Switching Point (SSP) is a voice switch that incorporates SS7 functionality. It processes voice-band traffic (voice, fax, modem, and so forth) and performs SS7 signaling. All switches with SS7 functionality are considered SSPs regardless of whether they are local switches (known in North America as an end office) or tandem switches.

An SSP can originate and terminate messages, but it cannot transfer them. If a message is received with a point code that does not match the point code of the receiving SSP, the message is discarded.

Service Control Point

A Service Control Point (SCP) acts as an interface between telecommunications databases and the SS7 network. Telephone companies and other telecommunication service providers employ a number of databases that can be queried for service data for the provision of services.

SCPs form the means to provide the core functionality of cellular networks, which is subscriber mobility. Certain cellular databases (called registers) are used to keep track of the subscriber's location so that incoming calls may be delivered. Other telecommunication databases include those used for calling card validation (access card, credit card), calling name display (CNAM), and LNP.

SCPs used for large revenue-generating services are usually deployed in pairs and are geographically separated for redundancy. Unless there is a failure, the load is typically shared between two mated SCPs. If failure occurs in one of the SCPs, the other one should be able to take the load of both until normal operation resumes.

Queries/responses are normally routed through the mated pair of STPs that services that particular SCP, particularly in North America.

2.2.4. Link types

Signaling links can be referenced differently depending on where they are in the network. Although different references can be used, you should understand that the link's physical characteristics remain the same. The references to link types A through E are applicable only where standalone STPs are present, so the references are more applicable to the North American market.

Six different link references exist:

- Access links (A links): They connect "outer" SPs (SSPs or SCPs) to the STP backbone

- Crossover links (C links): are used to connect two STPs to form a mated pair that is, a pair linked such that if one fails, the other takes the load of both.

- Bridge links (B links): are used to connect mated pairs of STPs to each other across different regions within a network at the same hierarchical level. These links help form the backbone of the SS7 network. B links are normally deployed in link quad configuration between mated pairs for redundancy.

- Diagonal links (D links): are the same as B links in that they connect mated STP pairs.The difference is that they connect mated STP pairs that belong to different hierarchical levels or to different networks altogether. For example, they may connect an interexchange carrier (IXC) STP pair to a local exchange carrier (LEC) STP pair or a cellular regional STP pair to a cellular metro STP pair.

- Extended links (E links): connect SSPs and SCPs to an STP pair, as with A links, except that the pair they connect to is not the normal home pair. Instead, E links connect to a nonhome STP pair

- Fully associated links (F links): are used to connect network SSPs and/or SCPs directly to each other without using STPs. The most common application of this type of link is in metropolitan areas. F links can establish direct connectivity between all switches in the area for trunk signaling and Custom Local Area Signaling Service (CLASS), or to their corresponding SCPs.

2.3. SS7 Protocol Overview

Figure 4. General protocol stack of SS7

2.3.1. Message Transfer Part (MTP)

The Message Transfer Part (MTP) consists of three levels (levels 1 to 3 of SS7). Its purpose is to reliably transfer messages on behalf of the User Parts across the SS7 network. The MTP maintains this service despite failures in the network.

2.3.1.1. MTP1

Layer 1 defines the physical interface. In Europe, SS7 is generally carried on a timeslot in a 2.048Mbps E1 trunk, generally timeslot 16 (but not necessarily). In North America, SS7 may be carried on either a V.35 synchronous serial interface running at 56 or 64kbps, or multiplexed on to a 1.544Mbps T1 timeslot The SS7 messages are constructed similar to HDLC frames (each message being delimited by ‘flag’ bytes or octets, and containing a Cyclic Redundancy Check, CRC).

2.3.1.2. MTP2

The layer 2 part of the protocol provides reliable transfer of messages between two adjacent nodes, ensuring that messages are delivered in sequence and error free. The SS7 protocol specifies that empty frames known as Fill in Signal Units (FISU) should be sent when no signaling information from the upper layers is waiting for transmission, hence the SS7 receiver always expects to receive frames (information or empty) continuously, enabling rapid detection of any failure or break in communication.

Layer 2 provides a method of message acknowledgement using sequence numbers and indicator bits in both the forwards and backward direction. Each information message carries a Forward Sequence Number (FSN) uniquely identifying that message. The message also carries a Backwards Sequence Number (BSN) acknowledging the FSN of the last message successfully received. Forward and Backward Indicator bits are toggled to indicate positive or negative acknowledgement.

The two common methods for handling errors on SS7 links are either the basic method, whereby a message is only retransmitted on receipt of a negative acknowledgement, and Preventative Cyclic Retransmission (PCR), whereby a frame is repeatedly sent when the upper layers have no information to be sent to the network. PCR is generally only used over transmission paths where the transmission delay is large, such as satellite links.

Before an SS7 link is able to convey information from the higher layers, the layer 2 entities at each end of the link follow a handshaking procedure known as the proving period, lasting for 0.5 to 8.2 seconds (depending on the availability of routes served by the link in question). During this time, Link Status Signal Units (LSSU) are exchanged between the layer 2 parts of the protocol, enabling both ends to monitor the number of received errors during this time. If less than a pre-set threshold, the link enters the IN SERVICE state, and may now carry Message Signal Units (MSU) containing information from the upper layers.

The layer 2 entities also monitor the state of the link and communicate link state information to their peers in layer 2 messages or Link Status Signal Units (LSSU). These are transmitted, for example, when links become congested or are taken out of service.

Figure 5. Basic SS7 message types

2.3.1.3. MTP3

Layer 3 provides the message routing and failure handling capabilities for the message transport. Each SS7 node (this could be a classic switch or a node containing 800 number translation records) is uniquely identified within a network using an SS7 address called a Point Code. European networks use 14 bit point codes, North American 24 bit point codes.

A single SS7 link is able to carry traffic for thousands of circuits (depending on traffic a single SS7 link is normally engineered to control 1000 to 2000 circuits), however, failure of this single link would disable all of the circuits that are controlled, hence for resilience and also to increase traffic capacity, more than one signaling channel is normally provisioned between any two nodes communicating using SS7. The collection of signaling links between two adjacent nodes is known as a link set, each link set can contain up to 16 signaling links. Figure 3 shows a simple SS7 network containing 3 nodes.

Figure 6 A simple SS7 network

MTP3 adds information into the Signalling Information Field (SIF) of the MSU. This includes a Destination Point Code (DPC) identifying the destination for a message, an Originating Point Code (OPC) identifying the originator of a message and a Signalling Link Selection (SLS) value used by MTP3 to load share messages between links in a link set.

Figure 7. MTP Header

The MTP automatically load shares between the links within a link set, and re-routes traffic from failed links to a working link within the same link set on detection of failure. MTP layer 3 also attempts to automatically restore failed links and returns traffic to a recovered link, these two procedures being termed Changeover and Changeback. MTP3 is also able to load share between two link sets that serve the same destination (through the use of intermediate nodes), the link sets here being contained within a route set.

MTP3 provides a reliable message transport service to the higher layer protocols, which use MTP as a message transport service, hence their generic name, User Parts. In order to deliver a received message to the correct user part, MTP3 examines the Service Indicator (SI) which forms part of the Service Information Octet (SIO) in the received message.

The SIO also contains the Network Indicator (enabling identification of a message travelling on a national or international network).

Figure 8. MTP3 Message Distribution

Routing of messages to a destination by MTP3 can either be Quasi Associated, where a message passes through an intermediate node before reaching its final destination or Fully Associated, in which case there is a direct signalling connection between the sender and recipient of a message. The intermediate nodes are known as Signalling Transfer Points (STP) which act as SS7 routers to provide multiple paths to a destination in order to handle failures within the network. The Classic SS7 architecture also defines two other types of nodes, a Service Switching Point (SSP) which is the point where the service user access the network (using an access protocol), and a Service Control Point (SCP) that contains network and data control functions (such as billing or free-phone number translation).