No.7信令系统的安全威胁及其防护

No.7信令系统（SS7）是公用电话网的关键支撑系统,SS7网络最初作为封闭网络来设计的,整个网络由运营商完全控制,各实体高度信任。文章分别针对该系统的信令协议、网络节点和来自外部网络的安全威胁进行了分析,并从协议安全、边界防护和内部安全加固三个方面提出了构建信令系统防护体系的方案。     

七号信令网中基于MTP3层的安全机制研究

七号信令系统作为电信网络的神经系统,其安全问题日益严重.给出了SS7网络面临的主要安全威胁,分析了攻击者利用网络缺乏认证机制,通过MTP3层的网络管理消息对七号信令网实施攻击.提出用密钥交换协议和认证头协议对MTP3层进行安全保护,增强SS7网络的安全性.     

高性能PCI/CompactPCI通信平台

TX3220和TX3220C是NMS Communications的TX系列接口板成员之一,为多种SS7(七号信令)提供功能强大和配置灵活的硬件平台.SS7(也称作C7)是电信级的信令协议,用于呼叫控制以及提供智能网(IN)和高级智能网(AIN)服务.SS7还经常作为信令协议支持VoIP网关以及广泛的增强型服务,包括语音/传真信息、单号码随身呼和预付费系统.NMS的TX系列产品全面支持SS7信令.     

流控制传输协议高级特性介绍

流控制传输协议(SCTP)是IETF为了实现在IP网络上传递电信的信号系统7(SS7)信令消息而设计的协议。在下一代通信网络中广泛采用信令传输协议(SIGTRAN)来传输控制信令,而SCTP是SIGTRAN协议的一个组成部分。SCTP是一种基于IP的可靠传输层协议,它的传输机制和高级特性,包括多宿主与多流的机制,使得它相对于传统的传输层协议(传输控制协议(TCP)、用户数据报协议(UDP))具有明显的优势。     

泰科来：高性能网络信令应用将越来越重要

电信网向全IP网络演进已是一个必然的趋势。近年来,全球各大运营商都在进行下一代基于IP技术的网络建设。目前,能够在IP网络上实现7号信令系统(SS7)的信令传输协议(Sigtran),被认为是演进至IMS(IP多媒体子系统)架构的基础。它能够让运营商首先将SS7信令业务转移至IP网     

LTE时代信令网网络组织与演进

LTE网络采用全IP网络架构,对比2G/3G时代以TDM为主的网络组织完全不同,LTE网络内部各网元间通信、LTE网与2G/3G网、固定电话网等网间互通如何实现。从信令演进趋势看,Diameter协议将取代传统的SS7协议,成为LTE网络广泛应用的核心网网元间通信协议,未来信令网络的发展趋势为IP化,Diameter信令网将长期与SS7信令网共存。     

MAP信令的安全保护研究

移动应用部分(MAP)协议是移动通信网络的信令协议,MAP协议消息是由7号信令网承载,而7号信令网是缺乏安全保护的。为保护在7号信令网上运行的MAP协议,必须利用另外的安全协议。MAP安全(MAPsec)协议为传输MAP消息提供了安全保证。文章研究了MAPsec协议的网络模型、保护模式、消息结构及交互流程,并提出了MAP信令的安全保护方法。     

七号信令协议分析仪的研究

七号信令系统(SS7)以其高效率,灵活性正在深入数字电话交换同和ISDN实验同中。随着SS7的开通,对其测试、维护的需求日益迫切。本文遵照CCITT1988年1月颁布的七号信令测试规范修正草案,就故障检测工具提出七号信令协议分析仪的设计思想,讨论了两种设计方案,对实现过程中遇到的问题给出了有效的解决办法。     

漫谈媒体网关控制协议

一、MGCP协议 媒介网关控制协议(MGCP)是由Level3公司牵头组成的论坛开发的Internet协议设备控制规范与Cisco/Bellcore(现为Telecord)合作开发的简单网关控制协议融合而成的,实现PSTN和IP网络的无缝集成。IETF在总结一些厂商建议的基础上,于1999年10月制定了统一而明确的MGCP规范.即RFC 2705。 MGCP其实是针对ITU-T H.323存在的问题,特别是为妥善处理与PSTN中SS7的信令接口的关系而发     

Internet电话原理

现在使用的普通电话采用线路交换方式,而In－ternet电话则采取报文交换方式,因此Internet电话通过PSTN时,在Internet与PSTN之间需经过话音同关转换,转换成符合Internet传输的IP数据报文,并遵循TCP／IP协议传输。Internet电话的通信方式分为3种：PC－to－PC、PC－to－Phone和Phone－to－Phone。其结构如图1所示。话音通过PSTN后,需经连接网关（CG）、话音同关（VG）分别与NO．7信令系统（SS7）网和IP网连接。其中CG完成IP协议（如H．323和SIP）和PSTN协议（如ISUP、PRI）之间的互联,SS7网充当其中介物;VG…     

A REASSEMBLY STRATEGY FOR REDUCING IN/PCS SIGNALLING TRAFFIC

This paper proposes a simple assembly/disassembly part (ADP) for the signalling system no. 7 (SS7) protocol to reduce the signalling traffic loads in intelligent networks (IN) and personal communication service (PCS) networks. The ADP combines two or more messages with the same destinations into a single message, thereby reducing signalling traffic without affecting SS7 protocol operations. The numerical results show that the proposed method can reduce traffic among signalling points 9∼17%.     

七号信令网MTP3层安全机制分析

七号信令网络由于缺乏安全机制而存在诸多安全漏洞。通过分析攻击者如何利用MTP3层的网络管理消息对七号信令网实施攻击,提出用密钥交换协议和认证头协议对MTP3层进行安全保护,从而实现了信令节点间的相互认证和对消息的完整性保护,增强了七号信令网络的安全性。     

ITU-T's internodal broadband signalling protocol

Broadband integrated services user part (B-ISUP) is an internodal signalling protocol defined by the International Telecommunications Union (ITU-T). Its purpose is to establish, maintain and release asynchronous transfer mode (ATM) connections in a public network, via the use of signalling messages. The initial release of B-ISUP was in February 1995, known as capability set 1 (CS-1). Since then, continued progress has been made extending the capabilities of B-ISUP with the development of CS-2. This paper provides an overview of the B-ISUP signalling protocol capabilities and describes its impact on the traditional Signalling System No 7 (SS7) architecture.     

Error monitoring issues for common channel signaling

Motivated by field data which showed a large number of link changeovers and incidences of link oscillations between in-service and out-of-service states in common channel signalling (CCS) networks, a number of analyses of the link error monitoring procedures in the SS7 protocol were performed by the authors. This paper summarizes the results obtained thus far and include the following: (a) results of an exact analysis of the performance of the error monitoring procedures under both random and bursty errors; (b) a demonstration that there exists a range of error rates within which the error monitoring procedures of SS7 may induce frequent changeovers and changebacks; (c) an analysis of the performance of the SS7 level-2 transmission protocol to determine the tolerable error rates within which the delay requirements can be met; (d) a demonstration that the tolerable error rate depends strongly on various link and traffic characteristics, thereby implying that a single set of error monitor parameters will not work well in all situations; and (e) some recommendations on a customizable/adaptable scheme of error monitoring with a discussion on their implementability. These issues may be particularly relevant in the presence of anticipated increases in SS7 traffic due to widespread deployment of advanced intelligent network (AIN) and personal communications service (PCS) as well as for developing procedures for high-speed SS7 links currently under consideration by standards bodies     

SCTP安全威胁分析及对策

流控制传输协议(SCTP)用于基于IP的网络上传输PSTN信令。本文在传输机制、多宿主机、多数据流等方面与TCP进行了特征比较,并进一步详细分析了SCTP存在的四种典型的安全威胁,提出了相应的解决方案。     

软交换系统七号信令设计

基于公共交换电话网络大规模应用七号信令的实际情况,对软交换体系结构、信令网关、初始会话协议(SIP)进行了描述。并针对下一代网络的分层思想、软交换的互联互通结构和呼叫流程,提出了利用软交换交换核心平台和信令网关及SIP相互配合实现七号信令的解决方案。描述了软交换系统的七号信令软件结构、信令网关的软件结构,阐述了相应呼叫流程的实现。     

Secure SCTP – A Versatile Secure Transport Protocol

The Stream Control Transmission Protocol (SCTP) is a new general purpose transport protocol defined by the IETF. Originally intended for the transport of voice signaling data (SS7) over IP networks, SCTP together with newly defined extensions is increasingly considered for other application scenarios as well. These require strong security solutions to authenticate the communication partners and protect sensitive data with respect to integrity and confidentiality. Proposals have been issued on how to protect SCTP transport by using standard security protocols such as TLS and IPsec. However, these solutions introduce limitations or inefficiencies und thus may not be able to fully exploit the capabilities of SCTP. Therefore, we propose a security extension to SCTP named Secure SCTP (S-SCTP) to solve these issues in an efficient and user-friendly way.