ppT=áåíêçÇìÅíáçå

SS7_SF_01_060418

I

S

U

PSCCP

T

U

PTCAP

MAPBSS

AP

RAN

AP

BSS

AP+

Users

RNS

AP

CAP INAP

MTP 3 MTP 3b M3UA

MTP 2SAAL-NNI SCTP

ATM IP

MTP 1 PHY L1 + L2

ST STMTP 2

Processor

`

ISUP

Processor

ISUP

error control

call handling

message handling

MTP 1 – signalling data linkMTP 2 – signalling linkMTP 3 – signalling network

0 16 31

MTP 3

TransportMTP

Application(“user part”)

ex. ISUP

transmission

SS7 overview

• circuit-related and non-circuit applications(inter-exchange, not on access interfaces)

• layered design(transport + application)

• common channel signalling(associated or quasi-associated)

• transport over PCM lines, ATM, IP

SS7 applications

• call handling in PSTN & PLMN (ISUP, TUP)• mobility & roaming (MAP, BSSAP+)• IN call handling (INAP, CAP)• RAN—core/RAN signalling (BSSAP, RANAP, RNSAP)

Classic SS7 layered structure

PCM coded speech8000 samples x 8 bits � 64000 bps

PCM line (E1)32 timeslots x 64 kbps � 2 Mbps

over PCM over ATM over IP

SS7 network elements

MTP rerouting onlylocal / transit exchangeMSC, BSC, HLR, ...SSF, SCF, ...

STP STP

SPSP SP

SL: channel for signalling messagesLS: all sig. links connecting two pointsSR: predetermined end-to-end path

SL LS

synch

ATM Asynchronous Transfer ModeBSC Base Station ControllerBSS Base Station SystemBSSAP Base Station System Application PartCAMEL Customised Application for Mobile network

Enhanced LogicCAP CAMEL Application PartGSM Global System for Mobile communicationsHLR Home Location RegisterINAP Intelligent Network Application Part

ISDN Integrated Services Digital NetworkISUP ISDN User PartIP Internet ProtocolLS Link SetM3UA MTP3 User AdaptationMAP Mobile Application PartMSC Mobile Switching CentreMTP Message Transfer PartPCM Pulse Code ModulationPLMN Public Land Mobile Network

PSTN Public Switched Telephony NetworkPS Packet SwitchedRAN Radio Access NetworkRANAP RAN Application PartRNS Radio Network SubsystemRNSAP RNS Application PartSAAL Signalling ATM Adaptation LayerSCCP Signalling Connection Control PartSCF Service Control FunctionSCTP Stream Control Transmission Protocol

SL Signalling LinkSP Signalling PointSR Signalling RouteSS7 Signalling System No. 7SSF Service Switching FunctionST Signalling TerminalSTP Signalling Transfer PointTCAP Transaction Capabilities Application PartTUP Telephone User PartUMTS Universal Mobile Telecommunications System

MTP 1

MTP 3

jqmI=é~êí=f

SS7_SF_02_ 060418

Signalling Link states

Idle – Out of serviceSIOS

Not alignedSIO

AlignedMSU FISU SIB SIPO

ProvingSIN or SIE

Normal or Emergencyalignment

Proving OK

Level 3order

Alignmentfailed

High errorrate onthe link

AERM

0.5 sec

1

8.2 sec

4

3

2

1

Normal alignment(max 5X)

Emergency alignment(max 1X)

SUERM

Failure

Ok

⊗⊗⊗⊗

⊗⊗⊗⊗

⊗⊗⊗⊗

⊗⊗⊗⊗

t

-1 if 256 SUs OK+1 if faulty SU

Loss of alignment64

# of errors

# of errors

CK SIF SIO LI EC F

BSNFSN BIB

FIBSINI

• routing label for MTP 3• user part information

• NI � national / international network• SI � SCCP, ISUP, TUP, …

for error detection2 2 4 1 7 1 7

CK LI EC F

no retransmissionsof FISU and LSSU

• 0 � FISU• 1 or 2 � LSSU• 2..63 � MSU

CK SF LI EC F

SIO, SIN, SIESIOS, SIPO, SIB

SIfor delimitationall fields between flagsrequire "bit stuffing":SEND: add 0 after every 11111RECV: delete 0 from every 111110

5 3

acknowledgements & retransmissions

� MSU

� LSSU

� FISU

16 max 8 * 272 8 2 6 16 8 bits

16 8 2 6 16 8 bits

16 2 6 16 8 bits

MTP level 2 functions

• transmission of level 3 messages in signal units• error detection and correction• signal unit delimitation• link alignment• link error monitoring

AERM Alignment Error Rate MonitorBIB Backward Indicator BitBSN Backward Sequence NumberCK Check bitsEC Error ControlF FlagFIB Forward Indicator BitFISU Fill-In Signal UnitFSN Forward Sequence Number

LI Length IndicatorLSSU Link Status Signal UnitMSU Message Signal UnitMTP Message Transfer PartNI Network IndicatorSF Status FieldSI Service IndicatorSIB Status Indication BusySIE Status Indication Emergency alignment

SIF Signalling Information FieldSIN Status Indication Normal alignmentSIO Service Information OctetSIO Status Indication Out of alignmentSIOS Status Indication Out of ServiceSIPO Status Indication Processor OutageSU Signal UnitSUERM Signal Unit Error Rate Monitor

I

S

U

PSCCP

T

U

PTCAP

MAPBSS

AP

RAN

AP

BSS

AP+

Users

RNS

AP

CAP INAP

MTP 3 MTP 3b M3UA

MTP 2SAAL-NNI SCTP

ATM IP

MTP 1 PHY L1 + L2

FailureOk

jqmI=é~êí=ff

SS7_SF_03_ 060418

MTP level 3 functions

• message routing• load sharing• message discrimination• message distribution• signalling network management• signalling link testing

I

S

U

PSCCP

T

U

PTCAP

MAPBSS

AP

RAN

AP

BSS

AP+

Users

RNS

AP

CAP INAP

MTP 3 MTP 3b M3UA

MTP 2SAAL-NNI SCTP

ATM IP

MTP 1 PHY L1 + L2

Routing & load sharing

2-55 2-66

2-10 2-20 2-30

STP

SP

STP

SP SP

SLC=0=1

DPC LS SLC

2-20 2-20 0

2-55 0 or 1

2-66 0 or 1

2-30 2-55 0 or 1… … …

load sharing (among SLs)load sharing (among LSs)

high priority

MTP addressing

DPCOPCSLS[ CIC ]UP msg

TUP and ISUP only

for loadsharing

12+4 4 14 14 2 2 2 bits

routing label

SINI

SIF SIO

whereFROM

whereTO

national (2)international (0)

OPC/DPCNI

National addressassigned nationally

International addressassigned by ITU-T

e.g. 2 – 8277

e.g. 0 – 7-246-1

Signalling AreaNetwork Code

pointcode

indicate node where UP creates/receives the message, not STP address

NI,DPC � SLSLS � one of SLsNI,DPC � deliver or rerouteSI � user part

SNM & SNT

• Signalling link managementcontrol locally connected links

• Signalling traffic managementdivert signalling among available links

• Signalling route managementdistribute status & routing info

• Signalling link testingafter alignment and periodically

Example procedures

COO

COA

TFP

RST

TFA

SLTM

SLTA

divert signalling fromunavailable link

rerouting to DPC=x not possible

rerouting to DPC=x possible again

periodic test: rerouting possible?

done by both sidestest bit pattern sent

0: SNM1: SNT3: SCCP4: TUP5: ISUP

messages sent in MSUs

CIC Circuit Identity CodeDPC Destination Point CodeLS Link SetLSSU Link Status Signal UnitMSU Message Signal UnitNI Network Indicator

OPC Originating Point CodeSANC Signalling Area Network CodeSI Service IndicatorSIF Signalling Information FieldSIO Service Information OctetSL Signalling Link

SLC Signalling Link CodeSLS Signalling Link SelectionSNM Signalling Network ManagementSNT Signalling Network TestingUP User Part

fprm

SS7_SF_04_ 060418

ISUP functions

• circuit-related call control (setup, conversation, cleardown)

• link-by-link signalling• interworking (older ISUP and other systems)• support for basic and supplementary

services

Example flow

IAMIAM

basic call setup

CPGCPG

ACM ACM

CPG CPG

ANM ANM

SUS SUS

RESRES

REL REL

RLCRLC

CGB

CGBA

CGU

CGUA

select circuitcreate messagethrough-connect �

called party found

event, e.g. alerting

called party answer

event, e.g. on-hold,forwarding, …

e.g. analogue on-hook

suspend & resume

call release

block group of circuits

unblock group of circuits

mandatoryvariable

SIF SIO

Message structure

CIC DPCOPC

SL

S

messagetype

mandatoryfixedoptional

ABCABCPD

POP

DE PE

LD

LH

LE

NHHL

KNKKE

OP

P = Pointer L = Length N = Parameter name OP = Optional Part EOP = End of Opt. Part

no CIC inSCCP

select circuitthrough-connect ��

connect ring tone (if speech)

through-connect ��

disconnectstop charging

O&M: block

through-connect �charge

circuit released

e.g. analogue off-hook

O&M: unblock

T7

T9

T2

T1T5

also SCCP

Interworkingwith other versions of ISUP

ABC

CFN• unknown msg• bad param• unknown param

ABC

• param X• param Y• param Z• param info

Confusion message Parameter compatibility info

• re-send modified message• send another message• release call

• param X: notify / discard / pass / release call• param Y: . . . . . / . . . . . . /. . . . . /. . . . . . • . . .

info what to do withunrecognized parameters

T1: max 15 .. 60 secexpiry � restart, resend

T5: max 5 .. 15 minexpiry � circuit reset

T7: max 20 .. 30sT9: max 1.5 .. 3 minexpiry � release

T2: max 3 minexpiry � release

I

S

U

PSCCP

T

U

PTCAP

MAPBSS

AP

RAN

AP

BSS

AP+

Users

RNS

AP

CAP INAP

MTP 3 MTP 3b M3UA

MTP 2SAAL-NNI SCTP

ATM IP

MTP 1 PHY L1 + L2

CIC Circuit Identity CodeDPC Destination Point CodeISDN Integrated Services Digital NetworkISUP ISDN User PartOPC Originating Point Code

SCCP Signalling Connection Control PartSIF Signalling Information FieldSIO Service Information OctetSLS Signalling Link Selection

p``m

SS7_SF_05_ 060418

I

S

U

PSCCP

T

U

PTCAP

MAPBSS

AP

RAN

AP

BSS

AP+

Users

RNS

AP

CAP INAP

MTP 3 MTP 3b M3UA

MTP 2SAAL-NNI SCTP

ATM IP

MTP 1 PHY L1 + L2

SCCP messages

UDTUDT

UDTUDT

UDT

UDTS

SCCP modes

Connectionless

Connection-oriented

• address included in each message• each message routed independently• GT translation in each node• class 0 � basic• class 1 � sequenced delivery

• used in GSM/UMTS core network

called addrcalling addruser data

sent iferror

RLCRLC

DT1DT1

setup

DT1DT1

DT1DT1dest ref no

user data

• addresses included in CR only• logical connection � ref numbers• fixed path in the network• class 2 � basic• class 3 � flow controlled

• used between MSC and BSC/RNC

RLSDRLSD

ITIT

sent when idle(5 .. 10 min)

CRCR

CCCC

datatransfer

release

format same as in ISUP

SCCP functions

• addition to MTP• global addressing & routing using GT• non-circuit related signalling• connectionless and connection-oriented

SCCP addresses

combination of• GT � routing• SSN � distribution• SPC

T(ias) expires � send ITT(iar) expires � releaseanything received � T(iar) reset T(iar) > 2 * T(ias)

GT translationstart of GT � next node DPC

GT: +48… +48601… +486014… +48601445

GT translation (optional)SSN � SCCP user

GT = digits + numbering plan + translation type + nature of addrSSN = number (1..255) identifying SCCP user

Addressing in 3GPP network

GMSC MSC/VLR

HLR

Call interrogationGT = MSISDN, NP = E.164, SSN = 6

First contactGT = MGT, NP = E.214, SSN = 6

IMSI = 260 01 1234567890MGT = +48 603 1234567890

Other casesGT = preconfigured or received earlier

SCCP management

• maintain status info on other nodes & their subsystems• MTP indications � node status• own broadcasts & tests � subsystem status

CL ConnectionlessCO Connection OrientedDPC Destination Point CodeE.164 ISDN/telephony numbering planE.212 IMSI numbering planE.214 ISDN/IMSI numbering planGT Global TitleMGT Mobile Global Title

MSISDN Mobile Subscriber ISDN NumberNP Numbering PlanRNC Radio Network Controller SSN SCCP Subsystem NumberSPC Signalling Point CodeSCCP Signalling Connection Control PartTT Translation Type

q`^m

SS7_SF_06_ 060418

I

S

U

PSCCP

T

U

PTCAP

MAPBSS

AP

RAN

AP

BSS

AP+

Users

RNS

AP

CAP INAP

MTP 3 MTP 3b M3UA

MTP 2SAAL-NNI SCTP

ATM IP

MTP 1 PHY L1 + L2

TCAP functions

• generic services for application entities• transaction-oriented communication• component handling • dialogue handling

Protocol model

MTP+SCCP

MAPMSC

MAPVLR

INAP

TCAP TCAPTCAP

ApplicationEntities

NetworkService

Part

TCAP useroperations

ASN.1 and BER

• higher layer protocols � complex data types• separate notation (ASN.1) from coding (BER)• complex types made from basic types � primitives & constructors

Tag

Length

Content

what IT is �

how long �

IT is

here IT is �

Tag

Length

Message type tag

Message length

Transaction Id tag

Transaction Id length

Transaction Id

Component portion tag

Component portion length

Component type tag

Component length

Operation code tag

Operation code length

Operation code

Invoke Id tag

Invoke Id length

Invoke Id

Operation parameters

ex. BEGIN

ex. 123

ex. INVOKE

ex. �

ex. Update Location

ex. IMSI, MSC/VLR addr

TCAP + MAP message

TCAP + MAP example

BEGIN 123INVOKE �Update location

(IMSI,MSC/VLR addr)BEGIN 456INVOKE � Cancel location

(IMSI)CONTINUE 123INVOKE � Insert subscriber data

(MSISDN,services)

CONTINUE 123RET. RESULT �

END 123RET. RESULT �Update location

(HLR addr)

END 456RET. RESULT �

HLRVLR VLR

new oldnew subscriber in VLR: location update

Component sublayercomponents: INVOKE, RET. RESULT, RET. ERRORinvoke id n

Transaction sublayermessages: BEGIN, CONTINUE, ENDtransaction id nnn

AE Application EntityASN.1 Abstract Syntax Notation OneBER Basic Encoding RulesHLR Home Location RegisterIMSI International Mobile Subscriber IdentityINAP Intelligent Network Application Part

MAP Mobile Application PartMS Mobile StationMSC Mobile Switching CentreNSP Network Service PartTCAP Transaction Capabilities Application PartVLR Visitor Location Register

SMS-IWMSC

j^mI=é~êí=f

SS7_SF_07_060418

MSC

HLR

VLR

MSC VLR

AUCEIR

SGSN GGSN

SMS-GMSC gsmSCF

B

MAP interfaces in GSM/UMTS

B

C

C:• interrogation at MT call (GMSC)• interrogation at MT SMS transfer

D

D: location and subscriber data management (CS)

E

E: • inter-MSC handover or relocation• SMS transfer

B: internal (not standardised)

Notes• MSC � MSC server if split architecture (Rel-4)• HLR+AUC+other database � Home Subscriber Server (HSS, Rel-5)• MAP also for: location services (R99), Gateway Location Register (GLR)• SCCP CL class 0 and 1 used, SSN mandatory

F

F, Gf: IMEI verification

G

G: IMSI and triplets retrieval

H

H: triplets requests(not standardised)

Gr

Gr: location and subscriber data management (PS)

Gc

Gf

Gc: interrogation at network-requested packet session(optional)

Gd

Gd: SMS transfer

E

C

“IN”

“IN”: MS state/location requests; USSD requests from MS

Every operation comes with Application Context version

Version negotiation

fixed part:“ETSI mobile GSM MAP AC”

AC name:“networkLocUpContext”1 name �� few operations (1..7)

MAP operation(sent in component)

AC version(sent in TCAP dialogue portion)

version(1,2,3,4)

UPDATE LOCATION 4 – 0 – 0 – 1 – 0 – 1 – 3

CONT/END ACCEPT AC v2INV/RET OP-Y/X (…)

ABORT ABORT AC v2

BEGIN OPEN AC v3INVOKE OP-X (…)

BEGIN OPEN AC v2INVOKE OP-X (…)

new dialogue

initial version based on dest addr (or default)

operation component optional

version OK

dialogue portion not used later

alternative version offered

MAP “versions”

AC Application ContextAUC Authentication CentreCL ConnectionlessCS Circuit SwitchedEIR Equipment Identity RegisterGGSN Gateway GPRS Support NodeGMSC Gateway MSCGPRS General Packet Radio Service

HLR Home Location RegisterIMEI International Mobile Equipment IdentityIMSI International Mobile Subscriber IdentityIN Intelligent NetworkIWMSC Interworking MSCMAP Mobile Application PartMSC Mobile Switching CentreMT Mobile Terminating

NP Numbering PlanPDP Packet Data ProtocolSCF Service Control FunctionSGSN Serving GPRS Support NodeSSN SCCP Subsystem NumberUSSD Unstructured Supplementary Service DataVLR Visitor Location Register

I

S

U

PSCCP

T

U

PTCAP

MAPBSS

AP

RAN

AP

BSS

AP+

Users

RNS

AP

CAP INAP

MTP 3 MTP 3b M3UA

MTP 2SAAL-NNI SCTP

ATM IP

MTP 1 PHY L1 + L2

j^mI=é~êí=ff

SS7_SF_08_060418

I

S

U

PSCCP

T

U

PTCAP

MAPBSS

AP

RAN

AP

BSS

AP+

Users

RNS

AP

CAP INAP

MTP 3 MTP 3b M3UA

MTP 2SAAL-NNI SCTP

ATM IP

MTP 1 PHY L1 + L2

HLR

MSCVLR

Example MAP procedures

Update location

Insert subsc. data

Update location

Insert subsc. data

Send routing info

Cancel location

GMSC

Cancel location

Process USS req

Send routing info

Check IMEI

Check IMEI

Get password

Activate SS

Get password

MSCVLR

Activate SS

Process USS req

location update (new subscriber, TMSI used)

return IMSI & unused triplets

delete subscriber record

update location info in HLR & get subscriber profile

incoming call with MSISDN

return white/grey/black

HLR

continue call with received MSRN

check phonee.g. at call setup

request handled in MSC, HLR, gsmSCF, or elsewhere

C I

Send Identification

E RR

E RR

B I

E RR

C RR

C I

B I

E RR

C RR

E RR

B I

E RR

B I

E RR

B I

B I

E RR

B= BEGINC= CONTINUEE= END

I = INVOKERR= RETURN

RESULT

Send Identification

EIR

Provide roaming no

Provide roaming no

E RR

B I

allocate & return MSRN

code required e.g. for barring services

Process USS reqProcess USS reqB I B IUSSD request received from MS

suppl. service management

(components sent to/from MS)

SGSN

SMS-GMSC

SMSC

Send routing info for SM

Send routing info for SME RR

B I

MT Forward SM

MT Forward SME RR

B I

return serving MSC address

Forward MO SM

Forward MO SME RR

HLR

Forward MT SM

Forward MT SME RR

B I

deliver SMS

MSCVLR

MO Forward SM

MO Forward SME RR

B I B ISMS via GPRS

from MS

ResetReset

sent to all VLRs and SGSNs on HLR reloadloc. update redone on radio contact

for all IMSIs from HLR

B I B I

SGSNHLRMSCVLR

to/from SMSC:not MAP

SMS-IWMSC

B / C / E BEGIN / CONTINUE / ENDI / RR INVOKE / RETURN RESULTIMSI International Mobile Subscriber IdentityMO Mobile OriginatedMSISDN Mobile Subscriber ISDN NumberMSRN Mobile Station Roaming Number

MT Mobile TerminatedSM Short MessageSMSC Short Message Service CentreTMSI Temporary Mobile Subscriber IdentityUSSD Unstructured Supplementary Service Data

gsmSCF

ST

P

SS

7_S

F_0

9_06

0418

LE

VL

R

TE

GM

SC

MS

C

HL

R

BS

S / R

NS

IAM

UD

T{B

EG

IN-I

NV

OK

E (

Sen

d R

outin

g In

fo)

}

UD

T{E

ND

-RE

TU

RN

RE

SU

LT (

Sen

d R

outin

g In

fo)

}

UD

T{B

EG

IN-I

NV

OK

E (

Pro

vide

Roa

min

g N

o)}

UD

T{E

ND

-RE

TU

RN

RE

SU

LT (

Pro

vide

Roa

min

g N

o)}

UD

T (

Pag

ing)

“Pag

ing”

Est

ablis

hmen

t ofs

igna

lling

radi

oco

nnec

tion

CR

(P

agin

g re

spon

se)

Pag

ing

resp

onse

CC

Aut

hent

icat

ion

and

star

t of s

ecur

ity fu

nctio

ns

Est

ablis

hmen

t of t

raffi

c co

nnec

tion

AC

M

Aw

aiti

ng

answ

er in

dic

atio

n (e

.g. r

ing

tone

)

IAM AC

M

CP

GC

PG

AN

MA

NM

IAM AC

M

CP

G

AN

M

Tra

ffic

SC

CP

rela

yS

CC

Pre

lay

DT

1 (C

onne

ct A

ck)

Con

nect

Ack

DT

1 (S

etup

)S

etup

DT

1 (C

all c

onfir

med

)C

all c

onfir

med

DT

1 (A

lert

ing)

Ale

rtin

g

DT

1 (C

onne

ct)

Con

nect

dial

led

no�

rout

eIS

UP

:se

lect

circ

uit

prep

are

mes

sage

MT

P: D

PC�

SL

LE

TE

calle

d pa

rty

num

ber

fwd

call

indi

cato

rsna

ture

of c

onne

ctio

ntr

ansm

issi

on m

ediu

m r

equi

rem

ent

[cal

ling

part

y nu

mbe

r][s

ervi

ce in

fo]

MS

ISD

Ndi

alle

d

dial

led

no�

inte

rrog

ate

MA

P+

TC

AP

:st

art d

ialo

gue

calle

d ad

dr =

MS

ISD

N

2-20

2-30

2-40

2-50

2-70

2-10

2-60

2-80

2-90

MT

P:

OP

C=

10D

PC

=20

MT

P:

OP

C=

20D

PC

=30

OP

C=

30 D

PC

=40

OP

C=

40 D

PC

=60

OP

C=

60 D

PC

=70

SC

CP

:•

[GT�

deliv

er]

•S

SN�

MA

P-H

LR

SC

CP

:G

T�

DP

CM

TP

:D

PC�

SL

MT

P: D

PC�

SL

SC

CP

:G

T�

DP

CM

TP

:D

PC�

SL

calle

d ad

dr(G

T=

MS

ISD

N,S

SN

=6)

calli

ng a

ddr

(GT

=G

MS

C,S

SN

=8)

tran

sact

ion

idin

voke

idA

C v

er

MS

ISD

NG

MS

C c

apab

ilitie

sin

terr

ogat

ion

type

[ser

vice

info

]

MS

ISD

N�

IMS

I�M

SC

/VLR

add

r

calle

d ad

dr(G

T=

VLR

,SS

N=

7)ca

lling

add

r(G

T=

HLR

,SS

N=

6)

IMS

IM

SC

add

r [s

ervi

ce in

fo]

MS

RN

MS

atta

ched

?al

loca

te M

SR

NM

SR

N��

IMS

Ist

art t

imer

MS

RN

cont

inue

cal

l set

upw

ith M

SR

N

dial

led

no�

rout

eIS

UP

:se

lect

circ

uit

prep

are

msg

MT

P: D

PC�

SL

calle

d pa

rty

no=

MS

RN

now

dial

led

no�

MS

RN

ser

ies

MS

RN�

IMS

Ire

leas

e M

SR

NIM

SI�

regi

stra

tion

area

IMS

I, T

MS

Iar

ea id

caus

e/ch

anne

l

no G

T, S

SN

=25

4 if

BS

SA

P14

2 if

RA

NA

P

TM

SI o

r IM

SI

allo

cate

& s

etup

:S

DC

CH

if G

ER

AN

SR

B if

UT

RA

N

star

t SC

CP

con

nect

ion

no G

Tsr

c re

f no

no G

Tsr

c re

f no

dest

ref

no

dest

ref n

o

[bea

rer

capa

bilit

ies]

[cal

ling

part

y nu

mbe

r]

[bea

rer

capa

bilit

ies]

allo

cate

& s

etup

TC

H if

GE

RA

NR

AB

if U

TR

AN

back

war

d ca

ll in

dica

tors

[ech

o co

ntro

l inf

o]

back

war

d ca

llin

dica

tors

— — —

even

t inf

o(=

aler

ting)

answ

er

ringi

ng

GE

RA

NG

SM E

DG

E R

adio

Acc

ess

Net

wor

kM

SR

NM

obil

e St

atio

n R

oam

ing

Num

ber

RA

BR

adio

Acc

ess

Bea

rer

SDC

CH

Stan

d-A

lone

Ded

icat

ed C

ontr

ol C

hann

el

SRB

Sign

allin

g R

adio

Bea

rer

TC

HT

raff

ic C

hann

el

UT

RA

NU

nive

rsal

Ter

rest

rial

Rad

io A

cces

s N

etw

ork

jçÄáäÉ=qÉêã

áå~íáåÖ=`~ää=bëí~ÄäáëÜãÉåí

`^jbi=~åÇ=`^m

SS7_SF_10_060418

gsmSCF

CAMEL introduction

incomingcall leg

outgoingcall leg

orders

reports/ack’s

• flexible call handling• in G/MSC and SGSN

• service logic and execution• in Home PLMNCAP

I

S

U

PSCCP

T

U

PTCAP

MAPBSS

AP

RAN

AP

BSS

AP+

Users

RNS

AP

CAP INAP

MTP 3 MTP 3b M3UA

MTP 2SAAL-NNI SCTP

ATM IP

MTP 1 PHY L1 + L2

R96R97/R98R99/Rel-4Rel-5/Rel-6

Ph 1: basic call rerouting, simple VPNPh 2: prepaid, DTMF and announcementsPh 3: call handling improvements, GPRS prepaidPh 4: IMS support, GPRS improvements

MAP

CAMEL Subscription Info:zero/one/many per IMSI

• trigger DP or list (O-/T-/VT-/GPRS-/SMS-CSI)

• mobility event or list (M-/MG-CSI)• SS code or list (SS-CSI)• service key• gsmSCF address• default call handling• dialled num (D-CSI only)

IN triggering

HLR

MSC

SGSN

GMSC

CSI sent in ISD at GPRS loc. updateGPRS sessionsattach/detach/RA updateMO/MT SMS via GPRS

CSI sent in SRI responseMT call forwarding of MT call

CSI sent in ISD at location updateall/selected MO/forwarded callsMT callsattach/detach/LA updateMO/MT SMSSS invoke notifications

Example CAP procedures

announcements andtone receivers

gsmSRF

gsmSSF

gsmSCF

gsmSRF

gsmSSF

ISUP

for CS call handling

VLR

SRI

ISD

ISD

M-CSI Mobility Management CSIMG-CSI Mobility Management for GPRS CSIMO Mobile OriginatingMT Mobile TerminatingO-CSI Originating CSIPLMN Public Land Mobile NetworkRA Routing AreaSCF Service Control FunctionSRF Specialised Resource FunctionSRI MAP Send Routing InfoSS Supplementary ServiceSS-CSI Supp. Service Invocation Notification CSISSF Service Switching FunctionT-CSI Terminating CSIVPN Virtual Private Network VT-CSI Visited MSC Terminating CSI

BCSM Basic Call State ModelCAMEL Customised Application for Mobile network

Enhanced LogicCAP CAMEL Application PartCS Circuit SwitchedCSE CAMEL Service EnvironmentCSI CAMEL Subscription InformationD-CSI Dialled Services CSIDP Detection PointDTMF Dual Tone Multiple FrequencyIMS IP Multimedia SubsystemIMSI International Mobile Subscriber IdentityIN Intelligent NetworkINAP Intelligent Network Application PartISD MAP Insert Subscriber DataLA Location Area

Disconnect Forward Connection–

Initial DPB#, service key, IMSIMSISDN, call ref no

Req Report BCSM Eventarmed DPs

Prompt And Collect User Infomsg/tone id, # of digits

Event Report BCSM Eventevent [, info]

service logicexecution starts

clear down at any phase

monitor call event(s)

e.g. for prepaid

proceed with suspended call

Apply Chargingtimer, tone? release? A/B?

Apply Charging Reportduration, active/released

Release Callcause

charging notification

release SSF-SRF connection

Connect To ResourcegsmSRF num

inband interactionask for DTMF digits

Continue–

set up SSF-SRF connection

route call to specificdestination

Connectcalled party number

event notification

call

actio

nstr

igge

rev

ent h

andl

ing

SR

F in

tera

ctio

n

jqm=çîÉê=^qj

SS7_SF_11_060418

I

S

U

PSCCP

T

U

PTCAP

MAPBSS

AP

RAN

AP

BSS

AP+

Users

RNS

AP

CAP INAP

MTP 3 MTP 3b M3UA

MTP 2SAAL-NNI SCTP

ATM IP

MTP 1 PHY L1 + L2

SSCF & SSCOP procedures

BGAK

SD (In Service)

POLL

STAT

BGN

SD (Normal)

POLL

STAT

link proving:repeat

1000 timesmax 30 sec

alignmentsuccessful

alignmentorder

other side doesthe same

ignored

Normal link alignment

SD N(S)=7N(S)=8N(S)=10N(S)=11

USTAT N(R)=7, lost list

SD N(S)=6N(S)=7N(S)=8N(S)=9 error

detected

Error control

STAT N(R)=3, lost list

SD N(S)=3N(S)=4N(S)=5

POLL N(S)=5

SD N(S)=1N(S)=2N(S)=3N(S)=4

pollingevery

100 ms reply topolling

SA

AL-

NN

IMessage handling

"simulation" of signalling linklink status control

CPAAL 5

SSCS

as classic MTP level 3, except:• max SIF size is 4095 octets (was 272)• new SNM procedure: extended changeover

n*48 octets sent as n ATM cellsno header / trailer added

error detectionpadding to m*48 octets

sequence and error controlflow controlconnection-oriented transmission

SIF SIO

SSCF PDU

InfoTrailer

more than 4 octets

4 octets

Pad

4 oct 0..3 max 4096

SAR PDU• uses ATM User-to-User Indication bit:� last/not last segment� in Payload Type in ATM header

4*n octets

MTP 3b

SSCF

SSCOP

CPCS

SAR

InfoTrailer Pad

8 oct 0..47 max 65535

48*m octets

Sent in Sequenced Data PDUTrailer:• PDU type (= SD here)• Pad Length (0..3)• N(S) – 24-bit send seq num

SAR PDU SSCF PDU

48 octets 48 octets

payload for one ATM cell

Trailer:• CRC for error detection• Length of Info• User-to-User Info not used• CP Indicator by SSCOP

Functional overview

ATM Asynchronous Transfer ModeCP Common PartCPCS CP Convergence Sub-layerCRC Cyclic Redundancy CheckNNI Network Node InterfaceN(R) Receive sequence NumberN(S) Send sequence NumberPDU Protocol Data UnitSAAL Signalling ATM Adaptation LayerSAR Segmentation And ReassemblySDU Service Data UnitSIF Signalling Information FieldSIO Service Information OctetSNM Signalling Network ManagementSSCF Service Specific Coordination

FunctionSSCOP Service Specific Connection Oriented

Protocol

ppT=çîÉê=fmI=é~êí=f

SS7_SF_12_060418

I

S

U

PSCCP

T

U

PTCAP

MAPBSS

AP

RAN

AP

BSS

AP+

Users

RNS

AP

CAP INAP

MTP 3 MTP 3b M3UA

MTP 2SAAL-NNI SCTP

ATM IP

MTP 1 PHY L1 + L2

RNC

RNC

MGW

MSCserver

trafficTE

VLR

HLR

G/MSC

HLR

SG

MGW

GMSCserver

Some SS7 over IP interfaces

RNSAP

ISUP

IP-based UTRAN IP-based CS core network non-IP PLMN/PSTN

RANAP

ISUP

MAP

MAP

IP-based Servers (IPS) if point-to-pointApplication Servers (AS) if via SG

Signalling Points (SP)

MAP//CAP

TCAP

SCCP

MTP 3

MTP 2

MTP 1

SCTP

L1+L2IP

M2UA

UserPart

MTP 3

Protocol overview

M2PA

UserPart

MTP 3

SCTP

L1 L2IP

M3UA

UserPart

SCTP

L1+L2IP

SUA

SCCPUser

SCTP

L1+L2IP

TUA

TCAPUser

SCTP

L1+L2IP

classic SS7SS7 over IP options

standardised forUTRAN and core net

• based on TCP• acknowledged, packet-oriented error-free, non-

duplicated data transfer• data segmentation• resistance to blind attacks• multi-homing support (primary + backups)

SCTP functions

Chunk[s] Header

SCTP packet

• verification tag• src + dest port num• checksum

• type, length, flags• stream id• SSN, TSN• other fields

if DATA

one or more in packet(“chunk bundling”)

Y

Y

X

Y

DATA DATA

HEARTBEAT

HEARTBEAT ACK

DATA

cookie = encryptedprotocol state data

INIT tag X [, backup addrs]

INIT ACK tag Y, cookie [, backup addrs]

COOKIE ECHO cookie [ DATA ]

COOKIE ACK [ DATA ]

start association

DATA TSN, SSN, payload data, …

DATA DATA DATA

SACK TSN, duplicates, gaps

DATA DATA

also sent to inactive

0

X

Y

X

too many retrans.� use backup

primary restored

AS Application ServerCS Circuit SwitchedIP Internet ProtocolIPS IP-based ServerM2PA MTP2 User Peer-to-peer AdaptationM2UA MTP2 User Adaptation

retransmissionsto backup addr

M3UA MTP3 User AdaptationMGW Media GatewaySCTP Stream Control Transmission ProtocolSG Signalling GatewaySP Signalling PointSSN Stream Sequence Number

SUA SCCP User AdaptationTCP Transmission Control ProtocolTE Transit ExchangeTSN Transmission Sequence NumberTUA TCAP User Adaptation

Example packet flow

Y

Y

X

Y

primary

backup

ppT=çîÉê=fmI=é~êí=ff

SS7_SF_13_060418

I

S

U

PSCCP

T

U

PTCAP

MAPBSS

AP

RAN

AP

BSS

AP+

Users

RNS

AP

CAP INAP

MTP 3 MTP 3b M3UA

MTP 2SAAL-NNI SCTP

ATM IP

MTP 1 PHY L1 + L2

M3UA introduction

• emulates MTP functions over IP+SCTP• supports multi-homing

primary + backup(s)load sharing

• two modesAS—SGIPS—IPS

M3UA

UserPart

SCTPM3UA

UserPart

SCTP

MTP3 primitives

IPS—IPS (“peer-to-peer” signalling)

IPS IPS

M3UA

UserPart

SCTPM3UASCTP

MTP3MTP2

AS—SG (“border” signalling)

MTP3 primitives

AS SG

Addressing & routing

• one SCTP association �� one or many RCs• dynamic RK registration possible

SCTP associationIP addr(s)

Routing KeyDPCSI listOPC or listCIC range

optional

• point codes still used (also for IP nodes)

Routing Context32-bit integer

n:1

1:1

ASPAC RCs, mode

ASPAC ACK RCs, mode

NTFY RCs, status

NTFY RCs, status

DAUD RC, DPC

DAVA RC, DPC

DATA SIO, SIF, RC

DATA SIO, SIF, RC

DATA SIO, SIF, RC

DUNA RC, DPC

DAUD RC, DPC

Example message flows

Network managementoptional RKregistration

Establishment of association

ASPUP ASP id

ASPUP ACK

ASPUP ASP id

ASPUP ACK

REG REQ RKs, RCs

REG RESP RKs, RCs

User Part data transfer

M3UA message

• version• message class& type

• length

• type• length• value(s)

Param Header…Param

AS Application ServerASP Application Server ProcessCIC Circuit Identity CodeDPC Destination Point CodeIPS IP-based Server

M3UA MTP3 User AdaptationOPC Originating Point CodeRC Routing ContextRK Routing KeySCTP Stream Control Transmission Protocol

SG Signalling GatewaySI Service IndicatorSIF Signalling Information FieldSIO Service Information OctetSP Signalling Point

status:• inactive• active• pending

mode:• override• loadshare• broadcast

remoteSP up

if loadsharing

remoteSP down

jÉëë~ÖÉ=äáëíë

SS7_SF_14_060418

CBA Changeback-acknowledgement signalCBD Changeback-declaration signalCNP Connection-not-possible signalCNS Connection-not-successful signalCOA Changeover-acknowledgement signalCOO Changeover-order signalCSS Connection-successful signalDLC Signalling-data-link-connection-order signalECA Emergency-changeover-acknowledgement signalECO Emergency-changeover-order signalLFU Link forced uninhibit signalLIA Link inhibit acknowledgement signalLID Link inhibit denied signalLIN Link inhibit signalLLT Link local inhibit test signalLUA Link uninhibit acknowledgement signalLUN Link uninhibit signalLRT Link remote inhibit test signalRCT Route-set-congestion-test signalRSM Route-set-test messageRSR Route-set-test signal for restricted destinationRST Route-set-test signal for prohibited destinationTFA Transfer-allowed signalTFC Transfer-controlled signalTFP Transfer-prohibited signalTFR Transfer-restricted signalTRA Traffic-restart-allowed signalUPU User part unavailable signal

(national options are in italics)

ANSI only

TCP Transfer-cluster-prohibited signalTCR Transfer-cluster-restricted signalTCA Transfer-cluster-allowed signalRCP Signalling-route-set-test cluster-prohibited signalRCR Signalling-route-set-test cluster-restricted signalTRW Traffic restart-waiting signal

MTP Signalling Network Management

SLTM Signalling Link Test MessageSLTA Signalling Link Test Acknowledgement message

MTP Signalling Network Testing

REL ReleaseRLC Release completeRSC Reset circuitRES ResumeSGM SegmentationSUS SuspendUBL UnblockingUBA Unblocking ackUCIC Unequipped CICUPA User Part availableUPT User Part test

ITU-T ISUP

CON ConnectCRG Charge informationFAA Facility acceptedFRJ Facility rejectFAR Facility requestOLM OverloadSAM Subsequent addressUSR User-to-user information

ANSI ISUP

CRM Circuit ReservationCVR Circuit Validation ResponseCVT Circuit Validation TestEXM Exit

ISDN User Part

ANSI only, removed from ITU-T

CMC Call Modification CompletedCMR Call Modification RequestCMRJ Call Modification RejectCSVR CUG Selection & Validation RequestCSVS CUG Selection & Validation ResponseDRS Delayed ReleaseFAD Facility DeactivatedFAI Facility Info

ETSI ISUP

APM Application TransportCON ConnectCRG Charge informationFAA Facility acceptedFRJ Facility rejectFAR Facility requestOLM OverloadPRI Pre-release InformationSAM Subsequent addressUSR User-to-user information

ITU-T and ETSI messages for nationaluse only are marked in italics. ANSI ISUP includes all these messages.

Common messages

ACM Address completeANM AnswerBLO BlockingBLA Blocking ackCPG Call progressCGB Circuit group blockingCGBA Circuit group blocking ackCQM Circuit group queryCQR Circuit group query responseGRS Circuit group resetGRA Circuit group reset ackCGU Circuit group unblockingCGUA Circuit group unblocking ackCFN ConfusionCOT ContinuityCCR Continuity check requestFAC FacilityFOT Forward transferIDR Identification requestIRS Identification responseINF InformationINR Information requestIAM Initial addressLPA Loop back ackLOP Loop preventionNRM Network resource managementPAM Pass-along

CR --xx Connection RequestCC --xx Connection ConfirmCREF --xx Connection RefusedRLSD --xx ReleasedRLC --xx Release CompleteDT1 --x- Data form 1DT2 ---x Data form 2AK ---x Data AcknowledgementUDT xx-- UnitdataUDTS xx-- Unitdata ServiceED ---x Expedited DataEA ---x Expedited Data AckRSR ---x Reset RequestRSC ---x Reset ConfirmERR --xx PDU ErrorIT --xx Inactivity TestXUDT xx-- Extended UnitdataXUDTS xx-- Extended Unitdata ServiceLUDT xx-- Long UnitdataLUDTS xx-- Long Unitdata Service

Second column indicates protocol class(es)(0,1,2,3) where given message may be usedMessages in italics used only over MTP-3b

SCCP

SSA Subsystem AllowedSSP Subsystem ProhibitedSST Subsystem Status TestSOR Subsystem Out-of-service RequestSOG Subsystem Out-of-service GrantSSC SCCP / Subsystem Congested

SCCP Management Components

Invoke (ITU-T)Invoke Last (ANSI)Invoke Not Last (ANSI)Return Result LastReturn Result Not LastReturn ErrorReject

Dialogue PDUs (ITU-T only)

AARQ Dialogue RequestAARE Dialogue ResponseABRT Dialogue AbortRLRQ Release RequestRLRE Release ResponseAUDT Uni-Dialogue

PDUs in italics are not used and includedfor completeness only (aligned with X.227).

Messages (ITU-T)

UnidirectionalBeginContinueEndAbort

TCAP

Messages (ANSI)

UnidirectionalQuery with PermissionQuery without PermissionResponseConversation with PermissionConversation without PermissionAbort

processGroupCallSignalling (R1997)processUnstructuredSS-Request (Ph2)processUnstructuredSSData (Ph1 only)provideRoamingNumberprovideSIWFSNumber (R1997)provideSubscriberInfo (R1996)provideSubscriberLocation (R1998)purgeMS (Ph2)readyForSM (Ph2)registerCC-Entry (R1997)registerPassword (Ph2)registerSSremoteUserFree (R1997)reportSmDeliveryStatus (Ph2)resetrestoreData (Ph2)secureTransportClass1 (Rel4)secureTransportClass2 (Rel4)secureTransportClass3 (Rel4)secureTransportClass4 (Rel4)sendAuthenticationInfo (Ph2)sendEndSignalsendGroupCallEndSignal (R1997)sendIdentification (Ph2)sendIMSI (Ph2)sendParameters (Ph1 only)sendRoutingInfosendRoutingInfoForGprs (R1997)sendRoutingInfoForLCS (R1998)sendRoutingInfoForSMsetMessageWaitingData (Ph1 only)setReportingState (R1997)SIWFSSignallingModify (R1997)ss-Invocation-Notification (R1997)statusReport (R1997)subscriberLocationReport (R1998)unstructuredSS-Notify (Ph2)unstructuredSS-Request (Ph2)updateGprsLocation (R1997)updateLocation

The GSM/3GPP phase/release in which an operation was introduced is given inparenthesis. 3G specific operations are shown in italics.

activateSSactivateTraceModealertServiceCentreanyTimeInterrogaton (R1996)anyTimeModification (R1999)anyTimeSubscriptionInterrogation (R1999)authenticationFailureReport (R1999)beginSubscriberActivity (Ph1 only)cancelLocationcheckIMEIdeactivateSSdeactivateTraceModedeleteSubscriberDataderegisterMobileSubscriber (Ph1 only)eraseCC-Entry (R1997)eraseSSfailureReport (R1997)forwardAccessSignallingforwardCheckSsIndication (Ph2)forwardGroupCallSignalling (R1997)forwardSM (Ph1 Ph2 only)getPassword (Ph2)informServiceCentre (Ph2)insertSubscriberDatainterrogateSSistAlert (R1999)istCommand (R1999)mo-forwardSM (R1996)mt-forwardSM (R1996)noteInternalHandover (Ph1 only)NoteMM-Event (R1999)noteMsPresent (Ph1 only)noteMsPresentForGprs (R1997)noteSubscriberDataModified (R1999)performHandover (Ph1 only)performSubsequentHandover (Ph1 only)prepareGroupCall (R1997)prepareHandover (Ph2)prepareSubsequentHandover (Ph2)processAccessSignalling

Mobile Application Part

ActivityTestActivityTestGPRS (Ph3)ApplyCharging (Ph2)ApplyChargingGPRS (Ph3)ApplyChargingReport (Ph2)ApplyChargingReportGPRS (Ph3)AssistRequestInstructions (Ph2)CallGap (Ph3)CallInformationReport (Ph2)CallInformationRequest (Ph2)Cancel (Ph2)CancelGPRS (Ph3)Connect

CAMEL Application Part

ReleaseCallReleaseGPRS (Ph3)ReleaseSMS (Ph3)RequestReportBCSMEventRequestReportGPRSEvent (Ph3)RequestReportSMSEvent (Ph3)ResetTimer (Ph2)ResetTimerGPRS (Ph3)ResetTimerSMS (Ph3)SendChargingInformation (Ph2)SendChargingInformationGPRS (Ph3)SpecializedResourceReport (Ph2)SplitLeg (Ph4)

ConnectSMS (Ph3)ConnectToResource (Ph2)ContinueContinueGPRS (Ph3)ContinueSMS (Ph3)ContinueWithArgument (Ph3)DisconnectForwardConnection (Ph2)DisconnectForwardConnectionWithArgument (Ph4)DisconnectLeg (Ph4)EntityReleased (Ph4)EntityReleasedGPRS (Ph3)EstablishTemporaryConnection (Ph2)EventReportBCSM

EventReportGPRS (Ph3)EventReportSMS (Ph3)FurnishChargingInformation (Ph2)FurnishChargingInformationGPRS (Ph3)FurnishChargingInformationSMS (Ph3)InitialDPInitialDPGPRS (Ph3)InitialDPSMS (Ph3)InitiateCallAttempt (Ph4)MoveLeg (Ph4)PlayAnnouncement (Ph2)PlayTone (Ph4)PromptAndCollectUserInformation (Ph2)

The CAMEL phase in which an operation was introduced is given in parenthesis.

ASPAC ASP ActiveASPAC ACK ASP Active AckASPDN ASP DownASPDN ACK ASP Down AckASPIA ASP InactiveASPIA ACK ASP Inactive AckASPUP ASP UpASPUP ACK ASP Up AckBEAT HeartbeatBEAT ACK Heartbeat AckDATA Payload DataDAUD Destination State Audit

DAVA Destination AvailableDEREG REQ Deregistration RequestDEREG RSP Deregistration ResponseDRST Destination RestrictedDUNA Destination UnavailableDUPU Destination UP UnavailableERR ErrorNTFY NotifyREG REQ Registration RequestREG RSP Registration ResponseSCON Signalling Congestion

Unused messages shown in italics.

M3UA

SCTP

ABORT AbortCOOKIE ACK Cookie AcknowledgementCOOKIE ECHO State CookieCWR Congestion Window ReducedDATA Payload DataECNE Explicit Congestion Notification EchoERROR Operation ErrorHEARTBEAT Heartbeat RequestHEARTBEAT ACK Heartbeat AcknowledgementINIT InitiationINIT ACK Initiation AcknowledgementSACK Selective AcknowledgementSHUTDOWN ShutdownSHUTDOWN ACK Shutdown AcknowledgementSHUTDOWN COMPLETE Shutdown Complete

Unused, reserved messages are in italics.

OS Out of ServicePO Processor OutageIS In ServiceNM NormalEM EmergencyANS Alignment Not SuccessfulMI Management InitiatedPE Protocol ErrorPNS Proving Not Successful

SSCF

SD Sequenced DataPOLL Status RequestSTAT Solicited Status ResponseUSTAT Unsolicited Status ResponseUD Unnumbered DataMD Management Data

PDUs not required by SSCFare marked in italics.

SSCOP

BGN BeginBGAK Begin AckBGREJ Begin RejectEND EndENDAK End AckRS ResynchroniseRSAK Resynch AckER Error RecoveryERAK Error Recovery Ack