The SS7 Protocol Stack

This page describes the components of the SS7 protocol stack. A stack is a set of data storage locations that are accessed in a fixed sequence. The SS7 stack is compared against the Open Systems Interconnection (OSI) model for communication between different systems made by different vendors.

Figure 1 shows the components of the SS7 protocol stack.

SS7 Level 1: Physical Connection

This is the physical level of connectivity, virtually the same as Layer 1 of the OSI model.This level is responsible for transmission of raw bits. Level 1 defines the physical, electrical, and functional characteristics of the digital signaling link. Physical interfaces defined include E-1 (2048 kb/s; 32 64 kb/s channels), DS-1 (1544 kb/s; 24 64kb/s channels), V.35 (64 kb/s), DS-0 (64 kb/s), and DS-0A (56 kb/s). SS7 specifies what interfaces will be used, both Bellcore (Telecordia) and ANSI call for either the DS0A or the V.35 interface.

Because central offices are already using DS1 and DS3 facilities to link one another, the DS0A interface is readily available in all central offices, and is preferred in the SS7 network. As the demands on the SS7 network increase (local number portability), and as the industry migrates toward ATM networks, the DS1 interface will become the link interface.

SS7 Level 2: Data Link

The data link level provides the network with sequenced delivery of all SS7 message packets. Like the OSI data link layer, it is only concerned with the transmission of data from one node to the next, not to its final destination in the network. Level 2 ensures accurate end-to-end transmission of a message across a signaling link. Level 2 implements flow control, message sequence validation, and error checking. When an error occurs on a signaling link, the message (or set of messages) is retransmitted. Sequential numbering is used to determine if any messages have been lost during transmission. Each link uses its own message numbering series independent of other links.


Figure 1: SS7 Protocol Stack



An SS7 message is called a signal unit (SU). There are three kinds of signal units: Fill-In Signal Units (FISUs), Link Status Signal Units (LSSUs), and Message Signal Units (MSUs) (Fig. 2).

Figure 2. SS7 Signal Units

Fill-In Signal Units (FISUs) are transmitted continuously on a signaling link in both directions unless other signal units (MSUs or LSSUs) are present. FISUs carry basic level 2 information only (e.g., acknowledgment of signal unit receipt by a remote signaling point). Because a CRC checksum is calculated for each FISU, signaling link quality is checked continuously by both signaling points at either end of the link. (Note: In the ITU-T Japan variant, signaling link quality is checked by the continuous transmission of flag octets rather than FISUs; FISUs are sent only at predefined timer intervals (e.g., once every 150 milliseconds).)

Link Status Signal Units (LSSUs) carry one or two octets (8-bit bytes) of link status information between signaling points at either end of a link. The link status is used to control link alignment and to indicate the status of a signaling point (e.g., local processor outage) to the remote signaling point.

Message Signal Units (MSUs) carry all call control, database query and response, network management, and network maintenance data in the signaling information field (SIF). MSUs have a routing label which allows an originating signaling point to send information to a destination signaling point across the network.

The value of the LI (Length Indicator) field determines the signal unit type:

LI Value
Signal Unit Type
0
 Fill-In Signal Unit (FISU)
1..2
 Link Status Signal Unit (LSSU)
3..63
 Message Signal Unit (MSU)

Figure 3. Message Type Length Indicator Value(s)

The 6-bit LI can store values between zero and 63. If the number of octets which follow the LI and precede the CRC if less than 63, the LI contains this number. Otherwise, the LI is set to 63. An LI of 63 indicates that the message length is equal to or greater than 63 octets (up to a maximum of 273 octets). The maximum length of a signal unit is 279 octets: 273 octets (data) + 1 octet (flag) + 1 octet (BSN + BIB) + 1 octet (FSN + FIB) + 1 octet (LI + 2 bits spare) + 2 octets (CRC).

Flag

The flag indicates the beginning of a new signal unit and implies the end of the previous signal unit (if any). The binary value of the flag is 0111 1110. Before transmitting a signal unit, MTP Level 2 removes "false flags" by adding a zero-bit after any sequence of five one-bits. Upon receiving a signal unit and stripping the flag, MTP Level 2 removes any zero-bit following a sequence of five one-bits to restore the original contents of the message. Duplicate flags are removed between signal units.

BSN (Backward Sequence Number)

The BSN is used to acknowledge the receipt of signal units by the remote signaling point. The BSN contains the sequence number of the signal unit being acknowledged. (See description under FIB below.)

BIB (Backward Indicator Bit)

The BIB indicates a negative acknowledgement by the remote signaling point when toggled. (See description under FIB below.)

FSN (Forward Sequence Number)

The FSN contains the sequence number of the signal unit. (See description under FIB below.)

FIB (Forward Indicator Bit)

The FIB is used in error recovery like the BIB. When a signal unit is ready for transmission, the signaling point increments the FSN (forward sequence number) by 1 (FSN = 0..127). The CRC (cyclic redundancy check) checksum value is calculated and appended to the forward message. Upon receiving the message, the remote signaling point checks the CRC and copies the value of the FSN into the BSN of the next available message scheduled for transmission back to the initiating signaling point. If the CRC is correct, the backward message is transmitted. If the CRC is incorrect, the remote signaling point indicates negative acknowledgment by toggling the BIB prior to sending the backward message. When the originating signaling point receives a negative acknowledgment, it retransmits all forward messages, beginning with the corrupted message, with the FIB toggled.

Because the 7-bit FSN can store values between zero and 127, a signaling point can send up to 128 signal units before requiring acknowledgment from the remote signaling point. The BSN indicates the last in-sequence signal unit received correctly by the remote signaling point. The BSN acknowledges all previously received signal units as well. For example, if a signaling point receives a signal unit with BSN = 5 followed by another with BSN = 10 (and the BIB is not toggled), the latter BSN implies successful receipt of signal units 6 through 9 as well.

SIO (Service Information Octet)

The SIO field in an MSU contains the 4-bit subservice field followed by the 4-bit service indicator. FISUs and LSSUs do not contain an SIO.

The subservice field contains the network indicator (e.g., national or international) and the message priority (0..3 with 3 being the highest priority). Message priority is considered only under congestion conditions, not to control the order in which messages are transmitted. Low priority messages may be discarded during periods of congestion. Signaling link test messages receive a higher priority than call setup messages.

The service indicator specifies the MTP user (Fig. 4), thereby allowing the decoding of the information contained in the SIF.

Service Indicator
MTP User
0
 Signaling Network Management Message (SNM)
1
 Maintenance Regular Message (MTN)
2
 Maintenance Special Message (MTNS)
3
 Signaling Connection Control Part (SCCP)
4
 Telephone User Part (TUP)
5
 ISDN User Part (ISUP)
6
 Data User Part (call and circuit-related messages)
7
 Data User Part (facility registration/cancellation messages)
8
 Reserved for MTP Testing User Part
9
 Broadband ISDN User Part
10
 Satellite ISDN User Part

Figure 4. Service Indicator Values

SIF (Signaling Information Field)

The SIF in an MSU contains the routing label and signaling information (e.g., SCCP, TCAP, and ISUP messages). The routing label is comprised of the destination point code (DPC), originating point code (OPC), and signaling link selection (SLS) field. Each signaling point in the SS7 network is uniquely identified by a numeric point code address. An ANSI routing label uses 7 octets; an ITU-T routing label uses 4 octets (Fig. 5).

Figure 5. ANSI vs. ITU-T SIO and SIF

ANSI point codes use 24-bits (three octets); ITU-T point codes typically use 14-bits. For this reason, signaling information exchanged between ANSI and ITU-T networks must be routed through a gateway STP, protocol converter, or other signaling point which has both an ANSI and an ITU-T point code. (Note: China uses 24-bit ITU-T point codes which are incompatible with both ANSI and other ITU-T networks). Interaction between ANSI and ITU-T networks is further complicated by different implementations of higher level protocols and procedures.

An ANSI point code consists of network, cluster, and member octets (e.g., 245-16-0). An octet is an 8-bit byte which can contain any value between zero and 255. Telcos with large networks have unique network identifiers while smaller operators are assigned a unique cluster number within networks 1 through 4 (e.g., 1-123-9). Network number 0 is not used; network number 255 is reserved for future use.

ITU-T point codes are pure binary numbers. However, like ANSI point codes, ITU-T point codes may also be given network, cluster, and member designations. For example, the point code 5557 may be stated as 2-182-5 (binary 010 10110110 101).

In ITU-T implementations, the SLS is interpreted as the signaling link code in ISUP messages.

CRC (Cyclic Redundany Check)

The CRC value is used to detect and data transmission errors. For more information, see the description for BIB above.

SS7 Level 3: Network Level

The network level depends on the services of Level 2 to provide routing, message discrimination and message distribution functions.

  • Message Discrimination determines to whom the message is addressed.

  • Message Distribution is passed here if it is a local message.

  • Message Routing is passed here if it is not a local message.

  • Message Discrimination

    This function determines whether a message is local or remote using the point code and data contained in a lookup table. Messages to remote destinations are passed to the message routing function for additional processing.

    Message Distribution

    Message distribution provides link, route and traffic management functions.

    Link Management

    This function uses the Link Status Signal Unit (LSSU) to notify adjacent nodes of link problems. Level 3 will send LSSUs via Level 2 to the adjacent node, notifying it of the problems with the link and its status.

    Diagnostics consists of realigning and resynchronizing the link.

  • Realignment—All traffic is removed from the link, counters are reset to zero, timers are reset and Fill-In Signal Units (FISUs) are sent in the meantime (called the proving period).

  • Proving Period—Amount of time FISUs are sent during link realignment. The duration of the proving period depends on the type of link used. Bellcore specifies the proving period for a 56 Kbps DS0 link is 2.3 seconds for normal proving and 0.6 seconds for emergency proving.

  • Another form of link management uses changeover and changeback messages sent using Message Signal Units (MSUs). MSUs advise the adjacent node to send traffic over another link within the same linkset. The alternate link must be within the same linkset.

    The bad link is being realigned by Level 3 while traffic is rerouted over alternate links. Changeback message is sent to advise the adjacent node that it can use the newly restored link again. Changeback messages are typically followed by a changeback acknowledgement message.

    Route Management

    This function provides a means for rerouting traffic around failed or congested nodes. Route management is a function of Level 3 and works together with link management.

    Route management informs other nodes of the status of the affected node. It uses Message Signal Units (MSUs) generated by adjacent nodes and is not usually generated by the affected nodes. (Link management only informs adjacent nodes.)

    Traffic Management

    This function provides flow control if a node has become congested. It allows the network to control the flow of certain messages based on protocol. Traffic management deals with a specific user part within an affected node.

    For example, if ISUP is not available at a particular node, a traffic management message can be sent to adjacent nodes informing them that ISUP is not available, without affecting TCAP messages on the same node.

    Message Routing

    Message discrimination in Level 3 will pass messages to message routing if it determines the message is not local. Message routing reads the called and calling party addresses to determine the physical address in the form of a point code.

    Every SS7 node must have its own unique point code. Message routing determines the point code from an address contained in the routing table.

    Message Transfer Part

    Protocols are used within the layers (levels) of the SS7 protocol to accomplish functions called for at each level. Levels 1, 2 and 3 are combined into one part, the Message Transfer Part (MTP). (See Figure 6)

    MTP provides the rest of the levels with node-to-node transmission, including basic error detection and correction schemes and message sequencing. It provides routing, message discrimination and distribution functions within a node.

    Standards Compliance


    Figure 6: Message Transfer Part Components


    SS7 Level 4: Protocols, User and Application Parts

    Level 4 consists of several protocols, user parts and application parts. (See Figure 7.)


    Figure 7:
    SS7 Level 4 Protocols, User and Application Parts


    TCAP

    Transactional Capabilities Application Part (TCAP) facilitates connection to an external database. Information/data received is sent back in the form of a TCAP message. TCAP also supports remote control—ability to invoke features in another remote network switch.

    OMAP (Operations, Maintenance and Administrative Part) is an applications entity that uses TCAP services for communications and control functions through the network via a remote terminal.

    MAP (Mobile Application Part) is used to share cellular subscriber information among different networks. It includes information such as the mobile identification number (MIN), and the serial number of the cellular handset. This information is used by the IS-41 protocol during cellular roaming.

    TCAP enables the deployment of advanced intelligent network services by supporting non-circuit related information exchange between signaling points using the SCCP connectionless service. An SSP uses TCAP to query an SCP to determine the routing number(s) associated with a dialed 800, 888, or 900 number. The SCP uses TCAP to return a response containing the routing number(s) (or an error or reject component) back to the SSP. Calling card calls are also validated using TCAP query and response messages. When a mobile subscriber roams into a new mobile switching center (MSC) area, the integrated visitor location register requests service profile information from the subscriber's home location register (HLR) using mobile application part (MAP) information carried within TCAP messages.

    TCAP messages are contained within the SCCP portion of an MSU. A TCAP message is comprised of a transaction portion and a component portion.

    Transaction Portion

    The transaction portion contains the package type identifier. There are seven package types:

    The transaction portion also contains the Originating Transaction ID and Responding Transaction ID fields which associate the TCAP transaction with a specific application at the originating and destination signaling points respectively.

    Component Portion

    The component portion contains components. There are six kinds of components:

    Components include parameters which contain application-specific data carried unexamined by TCAP.

    Standards Compliance

    ASP

    Application Service Part (ASP) provides the functions of Layers 4 through 6 of the OSI model. These functions are not presently required in the SS7 network, and are under further study. However, the ITU-T and ANSI standards do reference ASP as viable.

    SCCP

    Signaling Connection Control Part (SCCP) is a higher level protocol than MTP that provides end-to-end routing. SCCP is required for routing TCAP messages to their proper database.

    SCCP provides connectionless and connection-oriented network services above MTP Level 3. While MTP Level 3 provides point codes to allow messages to be addressed to specific signaling points, SCCP provides subsystem numbers to allow messages to be addressed to specific applications (called subsystems) at these signaling points. SCCP is used as the transport layer for TCAP-based services such as freephone (800/888), calling card, wireless roaming, and personal communications services (PCS).

    Global Title Translation

    Message Format

    SCCP Message Format

    SCCP Message Format

    Standards Compliance

    TUP

    Telephone User Part (TUP) is an analog protocol that performs basic telephone call connect and disconnect. It has been replaced by ISUP, but is still used in some parts of the world (China).

    ISUP

    ISDN User Part (ISUP) supports basic telephone call connect/disconnect between end offices. Used primarily in North America, ISUP was derived from TUP, but supports ISDN and intelligent networking functions. ISUP also links the cellular and PCS network to the PSTN.

    BISUP (Broadband ISUP) will gradually replace ISUP as ATM is deployed.

    The ISDN User Part (ISUP) defines the protocol and procedures used to set-up, manage, and release trunk circuits that carry voice and data calls over the public switched telephone network (PSTN). ISUP is used for both ISDN and non-ISDN calls. Calls that originate and terminate at the same switch do not use ISUP signaling.

    Basic ISUP Call Control

    Figure 8 depicts the ISUP signaling associated with a basic call.

    1. When a call is placed to an out-of-switch number, the originating SSP transmits an ISUP initial address message (IAM) to reserve an idle trunk circuit from the originating switch to the destination switch (1a). The IAM includes the originating point code, destination point code, circuit identification code (circuit "5" in Fig. 8), dialed digits and, optionally, the calling party number and name. In the example below, the IAM is routed via the home STP of the originating switch to the destination switch (1b). Note that the same signaling link(s) are used for the duration of the call unless a link failure condition forces a switch to use an alternate signaling link.

    2. Figure 8. Basic ISUP Signaling

    3. The destination switch examines the dialed number, determines that it serves the called party, and that the line is available for ringing. The destination switch transmits an ISUP address complete message (ACM) to the originating switch (2a) (via its home STP) to indicate that the remote end of the trunk circuit has been reserved. The destination switch rings the called party line and sends a ringing tone over the trunk to the originating switch. The STP routes the ACM to the originating switch (2b) which connects the calling party's line to the trunk to complete the voice circuit from the calling party to the called party. The calling party hears the ringing tone on the voice trunk.

      In the example shown above, the originating and destination switches are directly connected with trunks. If the originating and destination switches are not directly connected with trunks, the originating switch transmits an IAM to reserve a trunk circuit to an intermediate switch. The intermediate switch sends an ACM to acknowledge the circuit reservation request and then transmits an IAM to reserve a trunk circuit to another switch. This processes continues until all trunks required to complete the voice circuit from the originating switch to the destination switch are reserved.

    4. When the called party picks up the phone, the destination switch terminates the ringing tone and transmits an ISUP answer message (ANM) to the originating switch via its home STP (3a). The STP routes the ANM to the originating switch (3b) which verifies that the calling party's line is connected to the reserved trunk and, if so, initiates billing.

    5. If the calling party hangs-up first, the originating switch sends an ISUP release message (REL) to release the trunk circuit between the switches (4a). The STP routes the REL to the destination switch (4b). If the called party hangs up first, or if the line is busy, the destination switch sends an REL to the originating switch indicating the release cause (e.g., normal release or busy).

    6. Upon receiving the REL, the destination switch disconnects the trunk from the called party's line, sets the trunk state to idle, and transmits an ISUP release complete message (RLC) to the originating switch (5a) to acknowledge the release of the remote end of the trunk circuit. When the originating switch receives (or generates) the RLC (5b), it terminates the billing cycle and sets the trunk state to idle in preparation for the next call.
    ISUP messages may also be transmitted during the connection phase of the call (i.e., between the ISUP Answer (ANM) and Release (REL) messages.

    ISUP Message Format

    Figure 9. ISUP Message Format

    Figure 10. ANSI and ITU-T Initial Address Message (IAM) Format

    Figure 11. ANSI and ITU-T Address Complete Message (ACM) Format

    Figure 12. ANSI and ITU-T Answer Message (ANM) Format

    Figure 13. ANSI and ITU-T Release (REL) Message Format

    Figure 14. ANSI and ITU-T Release Complete (RLC) Message Format

    Standards Compliance

    BISUP

    Broadband ISDN User Part (BISUP) is an ATM protocol intended to support services such as high-definition television (HDTV), multilingual TV, voice and image storage and retrieval, video conferencing, high-speed LANs and multimedia.

    REFERENCES

    1. "SS7 Protocol " Cisco Whitepaper

    2. "SS7 Tutorial " Micro Legend Telecom Systems

    3. "SS7 Tutorial " Perfomance Technologies

    4. Online Education, International Engineering Consortium (IEC)

    5. SS7 Suite; Protocols.com


    Last updated on Feb 7, 2003
    ©2003 Pradip Bhuyan. All rights reserved.

    Site hosted by Angelfire.com: Build your free website today!