DANTU LAYOUT 11/2/06 12:03 PM Page 32

SS7 Over IP:

Signaling Interworking Vulnerabilities
Hemant Sengar, George Mason University
Ram Dantu, University of North Texas
Duminda Wijesekera and Sushil Jajodia, George Mason University

Abstract
Public telephony — the preferred choice for two-way voice communication over a
long time — has enjoyed remarkable popularity for providing acceptable voice quali-
ty with negligible connection delays, perhaps due to its circuit-switched heritage.
Recently, IP telephony, a packet-based telephone service that runs as an application
over the IP protocol, has been gaining popularity. To provide seamless interconnec-
tivity between these two competing services, the Internet Engineering Task Force
(IETF) has designed a signaling interface commonly referred to as SIGTRAN. This
seamless intersignaling provided by SIGTRAN facilitates any subscriber in one net-
work to reach any other subscriber in the other network, passing through any hetero-
geneous maze of networks consisting of either of these. Unfortunately, the same
intersignaling potentially can be exploited from either side to disrupt the services
provided on the other side. We show how this can be done and propose a solution
based on access control, signal screening, and detecting anomalous signaling. We
argue that to be effective, the latter two should consider syntactic correctness,
semantic validity of the signal content, and the appropriateness of a particular signal
in the context of earlier exchanged messages.

U ntil recently, public telephones — the overwhelm-

ing choice for two-way voice communication —
has provided acceptable voice quality with negligi-
ble connection delays. However, Voice over IP
(VoIP) telephony is emerging as an alternative to public tele-
phones, due to its convenience, cost effectiveness, and the
ease of designing new services. Consequently, there has been
a packet switched network. Being born in an era where a few
large enterprises owned and controlled the public telephony
infrastructure, the SS7 network has been engineered with per-
formance and failure tolerance in mind, but not security as a
design objective. Telecommunication deregulation in 1996 [2]
and liberalized economies have introduced many new players,
known as competitive local exchange carriers (CLECs), thus
a need to interoperate signaling and media between these two increasing the number of access points to SS7, and thereby
competing services. The signaling interoperation, made possi- exposing new points for attacks. As we show herein, one such
ble by using the signaling transport (SIGTRAN) [1] protocol interface to both networks, SIGTRAN, can be exploited as
suite proposed by the Internet Engineering Task Force well unless care is taken. We summarize the PSTN and VoIP
(IETF), allows any subscriber in either network to transpar- infrastructures before describing how their interoperation can
ently call another subscriber in either network. The malusabil- be exploited.
ity of the signaling interoperation and mechanisms, and
possible prevention mechanisms, comprise the subject matter
of our article.
Preliminaries
Designed in two different eras, the infrastructure of public Public Switched Telephone Network — Current public tele-
and VoIP telephones have different networking architectures. phone systems use separate networks for signaling and voice
Public telephony uses a signaling network known as Signaling streams, where the former controls (itself and) the latter,
System 7 (SS7) to set up and tear down connections for cir- referred to as common channel signaling. The combination of
cuit-switched voice trunks, whereas VoIP telephony is an these two networks are commonly referred to as the public
application running over the popular Internet Protocol (IP) — switched telephone network (PSTN), in which the control part
is commonly known as Signaling System 7 (SS7). SS7 is the
out-of-band signaling standard used by PSTN to control cir-
This material is based upon work supported by the National Science cuit-switched voice and data transmission, Integrated Services
Foundation under grants CT-0627493, IIS-0242237, IIS-0430402, Digital Network (ISDN) services, and optionally for, cellular
CNS-0516807, and CNS-0551694. Any opinions, findings, and conclu- mobile telephony and network management. SS7 provides
sions or recommendations expressed in this material are those of the both circuit-related and non-circuit-related signaling. As
author(s) and do not necessarily reflect the views of the National Science shown in Fig. 1a, the PSTN network is connected to the wire-
Foundation. less network through the mobile switching center (MSC) and

32 0890-8044/06/$20.00 © 2006 IEEE IEEE Network • November/December 2006

DANTU LAYOUT 11/2/06 12:03 PM Page 33

SCP
SS7 SS7 protocol model
STP STP levels
SSP SSP
Telephone STP STP Telephone ASE OMAP

SS7 signaling
network TCAP
Level 4 ISDN user part

Telephone
PBX
Public switched telephone
network (PSTN) Signaling connection
Fax Modem control part (SCCP)

Level 3 Message transfer part level 3

(signaling network)
Workstation
Mobile switching NSP Message transfer part level 2
center Internet Level 2 MTP
Comm. (signaling link)
tower
IP gateway PC Message transfer part level 1
Level 1 (signaling data link)
Cell
Pager phone

(a) (b)

■ Figure 1. SS7 network architecture: a) SS7 signaling network; b) SS7 protocol stack.

the Internet through IP gateways. Individual users and organi- MTP3 functions are divided into two areas, signaling message
zations access the PSTN network using dial-up, telephone, handling, ensuring proper delivery of messages, and signaling
PBX, and ISDN connections. network management, managing the signaling network. The
The interior of SS7 consists of three main network ele- signaling connection control part (SCCP) complements MTP
ments, referred to as signaling points (SPs). SPs are identified with the network service part (NSP) that is a functional equiv-
by a numeric address known as point codes, like the IP alent of the Open Systems Interconnection Reference Model’s
addresses of the Internet. SPs are classified as service switch- network layer. SCCP supports both connectionless and con-
ing points (SSPs), signaling transfer points (STPs), and service nection-oriented services while enhancing the addressing
control points (SCPs), depending upon their functions in the scheme. The transaction capabilities application part (TCAP)
SS7 network, as shown in the top half of Fig. 1a. In SS7 termi- is a non-circuit-related remote procedure call mechanism
nology, the addresses of senders and receivers are known offering four types of transactional services: request-response,
respectively as originating point codes (OPC) and destination response only upon success, response only upon failure, and
point codes (DPC), and are carried in a part of the SS7 mes- responseless service. Its most common use is in 800-number
sage’s header referred to as a routing label (RL). calling. TCAP uses SCCP as a transport layer to exchange
SSPs are (end offices or tandem) telephone switches that non-circuit-related data between applications. ISDN User Part
originate, terminate, or switch calls. An SSP may also send a (ISUP) provides functions to support basic bearer services
query message to an STP for logical to physical address trans- and supplementary services for voice and non-voice applica-
lation, referred to as global title translation. SCPs contain cen- tions in an ISDN. ISUP defines messages and protocols for
tralized databases that store information pertinent to the controlling interexchange calls (i.e., setting up and releas-
call-processing capabilities such as calling cards, subscriber’s ing of voice trunks) between two subscribers. Further details
profiles, and mobile-station profiles. Similar to an IP-based of the SS7 protocol stack can be found in [3].
router, based upon their DPC, STPs route incoming messages
to outgoing links. STPs can also be used to screen signals and Functional Components of PSTN, VoIP and Softswitch — PSTN
perform global title translations — mapping global mnemonic consists of two network planes (a plane represents a logical
addresses to point codes. grouping of communication procedures), one for signaling
and the other for voice transportation, that has lead to a high-
The SS7 Protocol Stack — The SS7 protocol stack consists of level system architecture consisting of call control and media
four functional levels, as shown in Fig. 1b. Levels 1 through 3 transport, which are being used to implement other applica-
together form the message transfer part (MTP) and are used tions, as shown in Fig. 2. Although legacy systems have imple-
for reliable point-to-point signal transfers. In addition, Level 3 mented all these functional units (as shown in the left side of
provides network management functions. Level 4 represents Fig. 2) in one physical location, the International Packet Com-
various services (known as user parts) of MTP Level-3 munications Consortium [4] and the IETF [1] have redesigned
(MTP3), such as telephone user parts, ISDN user parts, and a distributed architecture referred to as the softswitch architec-
signaling connection control parts. MTP is implemented at ture, as shown in the right side of Fig. 2.
each signaling point, but the user part’s implementation The softswitch architecture has three main components:
depends upon the services supported at that particular signal- media gateway (MG), media gateway controller (MGC), and
ing point. STPs provide routing functions and therefore user signaling gateway (SG). The MG operates at the transport
parts are absent. The MTP3 layer routes messages across sets plane of PSTN and is responsible for transferring voice
of MTP Level-2 (MTP2) links, controls network congestion, streams from the PSTN to VoIP networks and vice versa. The
balances loads, and reroutes MTP2 traffic from failed links. MGC is responsible for call control functionality such as set-

IEEE Network • November/December 2006 33

DANTU LAYOUT 11/2/06 12:03 PM Page 34

Legacy PSTN Functional planes in VoIP betwork

(circuit-switched solution) (Softswitched solution)

Feature/application server plane

Application and (SCP, service logic)
services

Open, standard interface

Proprietary, closed
environment Call control and signaling plane
(Media gateway controller (MGC), Softswitch)
Call control and
switching

Transport plane

IP transport domain Interworking domain

Transport IP backbone, routers, Media gateway (MG)
switches Signaling gateway (SG)

■ Figure 2. Softswitch architecture.

ting up, tearing down, and monitoring end-to-end call connec- networks. As a benefit, IP-based MGC could exchange signal-
tions, whereas MGCs control MGs using a master-slave rela- ing network management messages in the same way as any
tionship, mostly using the Megaco [5] protocol. SGs interface other network element (i.e., STP, SCP, or SSP) in the SS7
between the signaling part of the PSTN and the VoIP net- network. Figure 3a shows how MTP3 sits over M2UA in the
works by translating between SS7 signals and (to be described IP-based MGC.
below) SIGTRAN signals — namely, an adaptation layer that MTP2 Peer-to-Peer Adaptation Layer (M2PA) [7]: M2PA
transports SS7 signals over IP networks. allows SS7 links to be IP-based while maintaining SS7 link
topology. Service providers can maintain their SS7 network
The SIGTRAN Protocol Suite: Transporting SS7 Signals over IP topology while taking advantage of SS7 over IP. M2PA resem-
Networks — The SIGTRAN protocol suite proposes a new bles M2UA in aspects, such as allowing network management
common signaling transport protocol the Stream Control message transmission, and so on. The differences are in the
Transmission Protocol (SCTP), and its adaptation sublayers network design, where SG using M2PA has its own signaling
that support specific primitives required by a particular appli- point code and acts as an IP-based STP with the flexibility of
cation protocol of SS7 or ISDN. Figure 3a shows the SIG- performing global title translation operation.
TRAN architecture, which consists of three components: the MTP3 User Adaptation Layer (M3UA) [8]: M3UA allows
IP protocol, common signaling transport, and adaptation MTP3 user applications (e.g., ISUP and SCCP) in IP net-
modules. By maintaining SS7 service levels with an IP routing works to participate at the corresponding services in the SS7
architecture, network elements can take advantage of the cost network. M3UA passes the same primitives to upper layers as
benefits of the IP network in attempting to provide the relia- MTP3 in SS7 but does not provide the total functionality of
bility of the SS7. Many adaptation modules operating on top MTP3. Generally, M3UA is used between SG and MGC.
of SCTP provide the lower-layer services of SS7 and ISDN by Besides the user-part messages, some network management
means of interfaces to the upper-layer protocols and applica- messages (M3UA does not provide full network management
tions, and are summarized as follows. capability) are also delivered to the local M3UA-resident
MTP2 User Adaptation Layer (M2UA) [6]: M2UA trans- management functions of respective MGCs.
ports MTP3 signals over SCTP and IP, instead of SS7’s SCCP User Adaptation Layer (SUA) [9]: SUA carries
MTP2, and provides a way to use standard MTP3 of SS7 in IP transactional signaling messages (i.e., query and response type

SS7 network IP network

TCAP
SS7 IP
MTP3 ISUP SCCP TCAP ISDN
SS7 signaling point Signaling gateway Media gateway
controller
Adaptation
M2PA M2UA M3UA SUA IUA layer ISUP (NIF) ISUP
Signaling MTP3 MTP3 M3UA MTP3
SCTP transport MTP2 MTP2 SCTP MTP2
Internet MTP1 MTP1 IP MTP1
IP protocol

(a) (b)

■ Figure 3. SS7 transportation over IP network: a) SS7 over IP (the SIGTRAN architecture); b) SS7 ISUP message over IP using M3UA.

34 IEEE Network • November/December 2006

DANTU LAYOUT 11/2/06 12:03 PM Page 35

Telecommunication network Telecommunication network

IP network

SS7
Signaling signaling
plane SSP SSP SS7
link M2PA SIP/SIP-T M2PA signaling SSP
B D or or link
A C E Signaling
STP STP M3UA M3UA plane
SG SG
Voice Megaco MGC MGC Megaco
plane RTP media stream
Voice
Voice RTP SIP SIP RTP Voice plane
trunks MG trunks
Exchange A Exchange C MG Exchange E

Network elements Protocols

SG: Signaling gateway SIP: Session Initiation Protocol
MGC: Media gateway controller RTP: Real-Time Transport Protocol
MG: Media gateway IP phone PC
Megaco: Gateway Control Protocol
STP: Signaling transfer point M2PA: MTP2 peer-to-peer
SSP: Service switching point Adaptation layer
M3UA: MTP3 user adaptation layer

■ Figure 4. Interworking of VoIP and PSTN.

messages of the database) such as SCCP user applications, code) at the interface connecting IP and SS7 networks. Thus,
including TCAP. SUA replaces MTP and SCCP of the SS7 the threats arising in either of the networks due to misprovi-
protocol stack for better use of IP routing. Figure 3a shows sioned or malicious (e.g., hijacked) signaling nodes are not
the placement of SUA on top of IP-based SCTP. Mobile confined to that network alone, but may affect the other net-
Application Part (MAP), a TCAP application, uses the ser- work as well.
vices of SUA in an IP-based network in the same way as The main contribution of this article is the identification of
SCCP is use in an SS7 network. security threats in the interoperation of PSTN and VoIP sig-
naling through SIGTRAN. To the best of our knowledge, this
PSTN, VoIP Interworking Using SIGTRAN — As an example, is the first effort that addresses signaling vulnerabilities in the
Fig. 3b shows SS7 ISUP signaling message transportation integrated signaling network outside of the industrial sphere.
from the SS7 SP to IP-based MGC using the M3UA SIG- Out of many adaptation modules available in the SIGTRAN
TRAN adaptation layer. As shown, SG implements the nodal protocol suite, we have chosen SUA, M3UA, and M2PA as
interworking function (NIF) that exchanges IP-based MGC case studies. Nevertheless, our discussion is general enough
signals with the PSTN-based SPs. At the SG, the NIF acts as and can be extended to other adaptation modules as well.
the interface between MTP3 and M3UA. SS7 messages des- SUA is primarily used to carry transactional (i.e., TCAP)
tined to the MGC are received at the SG, the local MTP3’s content and replaces protocol layers in the SS7 stack up to
upper-layer interface delivers message parameters to NIF, and and including SCCP, thereby reducing the implementation
after translation the NIF delivers it to the M3UA’s message and management complexity. M3UA is the most popular and
distribution function for the final IP-based destination. Simi- widely deployed adaptation module used to carry SCCP,
larly, NIF reverse translates signals from MGC destined to the ISUP, and TCAP messages. M2PA is chosen because it main-
SS7 SP. tains the SS7 network topology over IP network and acts as an
In addition to signaling messages, voice packets belonging SS7 link replacement. M2PA-based signaling nodes are sym-
to communication sessions need to be routed through the MG metric in nature, whereas SUA and M3UA are examples of
where PSTN’s time-division-multiplexed (TDM) voice circuits asymmetric signaling nodes.
are converted to an IP’s packetized voice. Figure 4 shows the The rest of the article is organized as follows. We present
interworking of VoIP and PSTN networks. As shown, there various security threats, and then describe the current status
are three demarcation points: of security solutions developed so far for securing SS7 signal-
• SGs that translate signals ing network and IP-based signaling nodes. We propose a lay-
• MGCs that manage sessions and translate VoIP-based SIP ered security solution before concluding the article.
messages to ISUP messages
• MGs that translate IP-based RTP voice streams to PSTNs
voice trunks and vice versa.
Signaling-Message-Related Threats
In this section, we first describe various signaling messages of
Problem Statement and Organization of the Rest of the SS7 network and how these are mapped into SIGTRAN
the Article messages in the IP network. Subsequently we describe various
signaling-message-related threats.
Due to worldwide telecommunication deregulation, today’s Within SS7, a signal unit (SU), that is, an ordered set of
PSTN is open to all for a nominal fee. Therefore, telephone parameters, is an information block that is exchanged between
service providers with various levels of experience and ethics the SPs. Out of three types of SUs, the link-status signal units
can become CLECs and subsequently have the capability to (LSSUs) and fill-in signal units (FISUs) are exchanged
generate and inject SS7 messages. Similarly, the exponential between MTP2 modules of adjacent SP pairs. The LSSU mes-
growth of IP-based telephony will encourage Internet service sages convey link-status (i.e., recovery or initialization of the
providers (ISPs) to attach themselves to SS7 networks and link) information, whereas the FISU messages monitor the
provide IP telephony services. The adaptation layers of SIG- health of the links. A third type, a message signal unit (MSU),
TRAN (e.g., SUA, M3UA, M2PA, etc.) allow the possibility is used to carry network-management information (i.e., a mes-
for an SG (Fig. 4) to appear as an STP (with its own point sage originated by MTP3 at Level-3) or MTP3 user’s data

IEEE Network • November/December 2006 35

DANTU LAYOUT 11/2/06 12:03 PM Page 36

SS7 signaling IP SS7 signaling IP

network network network network

STP STP STP STP

B D B D

SP A DUNA SP A SCON
IFP TFP TFC (A)
STP TFP STP Signaling Media STP TFC (A) STP Signaling Media
C E gateway gateway C E gateway gateway
(SG F) controller (SG F) controller
Malicious SP (MGC) Malicious SP (MGC)

(a) (b)

■ Figure 5. M3UA network management messages threats originating from an SS7 network: a) DUNA message attack; b) SCON mes-
sage attack..

(i.e., a message originated by MTP3-User at Level-4) between Integrity and authentication services could be provided by IP
SPs. Security (IPsec), but those terminate at the SGs. Network
Within an IP network, various SIGTRAN adaptation layers level IPsec security services are not good enough to protect
follow a very generic packet format consisting of a common against vulnerabilities at the application level. Hijacked or
header followed by zero or more parameters that depends upon misbehaving SS7 signaling nodes can still inject spurious SNM
the message type, but using the standard TLV notation where messages addressed to MGCs, aimed at disrupting VoIP ser-
the tag (i.e., an identifier of the type of the parameter), length vices. Similarly, SNM messages generated at misbehaving SGs
(i.e., size of the parameter), and value (i.e., the actual informa- may affect the functioning of SS7 nodes. In this section, we
tion) are specified. The common header contains the adapta- discuss the vulnerabilities of SNM messages for M3UA and
tion layer version, message class, message type, and message M2PA adaptation layers. Even with IPsec running between
length. SG maps SS7 signaling messages into a message class SGs and MGCs, IP-based signaling nodes can be compro-
and a message type-5 of the common header and their parame- mised with some coordination between the malicious (or
ters into relevant TLV format parameters. For the M2PA mes- hijacked) signaling nodes (SS7 nodes or SGs), and the SNM
sages, the header is followed by a M2PA-specific message messages may be used to make selected signaling links or
header and data. The user data type of the M2PA message con- routes unavailable, thereby causing traffic diversion to a
tains SS7 MSU information in the message data field. selected route. Next we describe some sample attacks that can
Signaling-message-related threats are due to the lack of originate inside the SS7 signaling network targeting M3UA
authentication and integrity mechanism in the SS7 network, and M2PA-based IPSPs.
leaving open the possibility of unauthorized message content
(i.e., parameters and their values) and structure manipulation. M3UA: Network Management Messages Attack — The SNM
messages carrying SS7 network conditions received at an SG
Threats Due to Compromised Signaling Nodes are conveyed to appropriate application server processes
The possibility of hijacked (or compromised) signaling nodes (ASPs), that is, an SCTP association’s other end point config-
in the SS7 or IP network can exploit the signaling messages to ured to process signaling traffic running at IP-based signaling
disrupt telephone services. In this section we describe poten- nodes. Some examples of ASPs are the signal handling pro-
tial threats due to various signaling messages at different lev- cesses running at MGCs and IP-based SCPs. The SS7 native
els of the SS7 protocol stack. SNM messages are converted to appropriate ASP manage-
ment messages at the SGs, before being transported over the
Level 2: Threats Due to Link-Status Messages of the M2PA Adap- IP network. The SS7 signaling network management messages
tation Layer — The LSSU (i.e., signaling-link control message) related to ASPs are defined as destination unavailable
of the SS7 and link-status message (LSM) of IP-based signal- (DUNA), destination available (DAVA), destination state
ing links are used to convey the link status between adjacent audit (DAUD), signaling congestion (SCON), destination user
signaling nodes. LSSUs are exchanged between directly con- part unavailable (DUPU), and destination restricted (DRST)
nected SPs, and in IP network, LSMs are sent between M2PA messages. Hijacked SS7 nodes or compromised SGs can
peers using SCTP associations over IP. SCTP associations are exploit the network management messages to affect the prop-
created between two IP-based signaling points (IPSPs), but are er functioning of a signaling network.
not as direct as in SS7, because there can be many devices DUNA Message Attack: DUNA messages are sent from an
such as routers connected between two peers. Hence in an IP SG to all concerned ASPs (i.e., MGCs) to signal the unreach-
network, link-status messages also need to be secured. Spoofed ability of an SG by some destinations within the SS7 network.
link-status messages such as Processor Outage, Busy, Out of If an MTP3-user does not find an alternate route via another
Service, and so on may pose a security threat and possibly SG, signal traffic (and therefore voice services) to the affected
resulting in suspending signaling-link operation. destination is suspended, thereby denying voice services. Fig-
ure 5a shows a scenario in which this message can be used to
Level 3: Exploiting MTP3 Signaling Network Management launch a denial-of-service attack. In Fig. 5a, the target SG-F
(SNM) Messages — Signaling Network Management (SNM) has active links to STP-D and STP-E. Signaling traffic from
messages are used to ensure the proper functioning of the SS7 MGC destined to SP-A can be routed through STP-D or STP-
network under abnormal conditions such as congestion, link E, depending upon the employed load balancing algorithm.
failures, and so forth. We show how to exploit the absence of Now suppose a malicious SP (say, STP-C) sends a transfer
message integrity and authentication in the SS7 network. prohibited (TFP) SNM signal to its neighbors STP-B, STP-D,

36 IEEE Network • November/December 2006

DANTU LAYOUT 11/2/06 12:03 PM Page 37

and STP-E, indicating its inaccessibility to SP-A. If STP-C is dination between malicious nodes, then it is possible to make
in their access control list, then it is authorized to initiate this believe that the selected link is unavailable, thus resulting in
process and in turn respective STPs will make appropriate diverting traffic to other links and thereby wasting resources.
modification to their routing tables, resulting in traffic diver-
sion. Moreover, if the malicious STP-C sends another TFP Level 4: Exploiting SCCP Management Messages — The
signal to STP-D and STP-E on behalf of STP-B, indicating its SCCP management (SCMG) function maintains the smooth
inability to reach SP-A, then there are no routes available for transferring capability of SCCP messages during network fail-
SG-F to reach the destination SP-A. SG-F, being unaware of ures and SCCP subsystems downtimes. SCMG messages
this attack, informs the MTP3-user parts about the unavail- inform the SCCP users to stop sending any further messages
ability of SP-A. Consequently, TFP and DUNA signals can be and, if possible, advise SCCPs to reroute messages to other
exploited to isolate SPs, divert traffic and overload routes. backup subsystems. At the SG, SUA layer interworks with
SCON Message Attack: An SG realizing a route congestion SCMG function to interoperate between SS7 and IP net-
to some destination in SS7 sends an SCON signal to all con- works. The SS7 SCMG messages pertaining to SS7 network
cerned ASPs. In response, these ASPs send a MTP-status indi- conditions received at an SG are conveyed to application serv-
cation to its local MTP3-users. The MTP3-users reduce their er processes (ASPs) running at IP-based signaling nodes after
traffic rate towards the affected point code. In Fig. 5b we converting them to appropriate ASP management messages
show how this can be turned into an attack scenario. Suppose (such as DUNA, DRST, DUPU, and SCON messages), before
that malicious STP-C sends a transfer controlled (TFC) SNM being transported over the IP network.
message to SG-F, indicating its route to SP-A is congested. Loss of integrity or lack of authentication of SCMG mes-
On receipt, SG-F sends an SCON message to concerned ASPs sages at SGs may be used to isolate an ASP or an SS7 node
so that M3UA passes a MTP-status primitives to its users, and its subsystem from an SG. For example, a DUNA mes-
thus resulting in resource underutilization. sage is sent from an SG to its local SUA-user at an ASP when
a destination or SCCP-user becomes unreachable. The SUA-
M2PA: Network Management Messages Attack — M2PA- user at the ASP stops sending traffic to the affected destina-
based IPSPs have the MTP3 layer and are thus allowed to tion or SCCP-user through the SG that sent the DUNA
perform their message handling and network management func- message. At the SG, SCMG messages originating at the SS7
tions as other SS7 nodes. Compromised IPSPs, hijacked SS7 side are not authenticated and therefore could be used by a
nodes, or fabricated management messages are equally threat- hijacked SS7 node to launch a DoS attack against an ASP
ening to the functioning of the integrated signaling network. running at an IPSP. Similarly, a misbehaving SG at the inter-
Changeover Order Attack: Changeover procedure diverts face or an ASP (residing at an IPSP) may be used to generate
signaling traffic from a currently unavailable (due to failure, spurious management messages to affect a SS7 nodes or its
blocking, or inhibiting) signaling link to an available alterna- SCCP subsystems.
tive signaling link without loss, duplication, or missequencing There are various other network management procedures
of messages. This initiates changeover actions by the signaling that may pose threats to the signaling network. The underly-
nodes (say, SP-A and SP-B in the case of a SS7 network and ing problem of the lack of integrity and authentication check
IPSP-X and IPSP-Y in the case of an IP network) at both is common among most of them. Table 1 lists some critical
ends of the signaling link. For example, suppose SP-A sends management messages used by the SS7 and IP-based signaling
changeover order (COO) or extended changeover order nodes.
(XCO) message to SP-B. These messages say that the signal-
ing link identified by the particular DPC/OPC/signaling-link Threats Due to Spoofed or Fabricated Signaling
code (SLC) parameter combination is unavailable. COO mes- Messages
sages are used by the SS7 SPs, whereas XCO messages are
used between IPSPs because M2PA uses 24 bit sequence SS7 network’s gateway screening [10] is the only widely
numbers in contrast to MTP2’s COO message with seven bit deployed security solution available today, but does not check
sequence numbers. The receiving signaling node has no mech- the actual content and structure of the signaling messages.
anism in place to check the origination of this message other Therefore, the responsibility of parsing and interpreting the
than to believe its RL. Currently, the only known security message parameters falls upon the SSPs/SCPs and IPSPs,
measure in place is an access control mechanism that specifies where higher layers of the SS7 protocol stack (i.e., TCAP,
whether the OPC contained in messages’s RL is authorized to ISUP, etc.) reside. Inability to interpret or properly parse
perform such an operation. On arrival, the OPC of the mes- messages with inappropriate contents may cause problem at
sage is compared with the available access control list (ACL), the signaling node and thereby affect telephone services. As
maintained manually by network operators at the node speci- an example, consider ISUP’s initial address message (IAM)
fying which network management procedures are allowed and populated with the multilevel precedence and preemption
by which nodes. If the RL contains the OPC of SP-A (or (MLPP) parameter that identifies the network resources to
IPSP-X), then it is assumed to be originating at the correct which the MLPP supplementary service is applicable. MLPP
and authorized node, or else it will not be allowed to perform service is used by the government and emergency services on
such network management operations. This access control government’s signaling networks. Therefore, such IAMs com-
mechanism is still devoid of solving fabricated message attacks ing to a commercial switch may not be properly parsed.
towards SP-B (or IPSP-Y). For example, suppose a malicious Another example is the populating circuit identification code
or hijacked node SP-M (or IPSP-M) can send a fabricated (CIC) of the IAM message with value 0000, which may arise
network management message towards SP-B (or IPSP-Y) by due to a misprovisioned CLEC’s switch. Other threats affect-
spoofing the OPC of SP-A (or IPSP-X) that is authorized to ing individual subscribers may also arise by modifying message
send network management messages. SP-B (IPSP-Y), believ- parameters. Parameters such as automatic number identifica-
ing that the RL of the message will start the changeover pro- tion (ANI) and caller ID provide essential services to the sub-
cedure, stops sending the messages to the link specified in scribers and, if spoofed, may deny these services.
COO (XCO) message, thereby making the signaling link Another set of potential threats arises in the environment
unavailable. If the victimized node is attacked with some coor- where a part of the call involves PSTN interworking with the

IEEE Network • November/December 2006 37

DANTU LAYOUT 11/2/06 12:03 PM Page 38

SS7 protocol layer and its management

SS7 network management messages in IP networks Security features
messages

At SG, SUA layer interworks with SCCP management

SS7 level 4: SCCP function and provides indications to appropriate ASPs
SCCP management messages: (i.e., IP signaling nodes) by using existing ASP • Integrity and authentication
• Subsystem prohibited networks management messages such as: mechanism across SS7 and IP
• Subsystem out-of-service request • Destination restricted (DRST) networks
• Subsystem status test • Destination unavailable (DUNA) • Protocol behavior monitoring
SIGTRAN layer: SUA • Signaling congestion (SCON)
• Destination user part unavailable

Message transfer part level 3

Signaling network management (SNM) At SG, M3UA layer provides interworking with MTP3
messages: management function by using ASP management
• Integrity and authentication
• Emergency changeover order messages such as:
mechanism across SS7 and IP
• Changeover order • Destination restricted (DRST)
networks
• Transfer prohibited • Destination unavailable (DUNA)
• Protocol behavior monitoring
• Transfer controlled • Signaling congestion (SCON)
• Transfer restricted • Destination user part unavailable
SIGTRAN layer: M3UA

M2PA-based SGs and IPSPs have their own MTP3 layer, • Integrity and authentication
M3UA message transfer part level 3
and therefore can perform all message handling and mechanism across SS7 and IP
Signaling network management (SNM)
network management functions. SS7 nodes and networks
messages: same as above
M2PA-based IPSPs are equally vulnerable to fabricated • Access control on nodes
SIGTRAN layer: M2PA
MTP3 SNM messages. • Protocol behavior monitoring

Message transfer part level 2

M2PA-based peers exchange MTP2 link status
Signaling link management messages
messages (similar to LSSU of SS7 network). The M2PA
• Out of alignment
link is not as direct as the MTP2 signaling link. There • Integrity and authentication
• Emergency alignment
may be many other network elements lying in the mechanism between IPSP peers
• Out of service
path between two M2PA peers. Fabricated link status • Protocol behavior monitoring
• Processor outage
messages pose serious threats to IPSP signaling links
• Busy
and nodes.
SIGTRAN layer: M2PA

■ Table 1. Some critical management messages in IP and SS7 networks.

session initiation protocol (SIP) or H.323 (an international For example, SIP messages between MGCs (Fig. 4) con-
standard for multimedia communication over packet-switched tains topological information in their header fields, such as
networks). For example, MGCs are used to bridge SIP and Via and Record-Route. Similarly, the Protocol Data param-
ISUP networks so that calls originating in the PSTN can reach eter of M3UA and the User Data field of M2PA messages
IP telephone endpoints and vice versa, or calls originating and contain the point codes of SS7 signaling nodes and sub-
terminating in PSTN may go through MGCs and a SIP net- scriber specific data. Data recorded from such traffic can
work in between, as shown in Fig. 4 [11]. In all these cases, be used later on to mount attacks on a specific user or the
SS7 to VoIP interworking is facilitated by mapping ISUP mes- network itself. As a result, there is a need to mask the rout-
sages into SIP messages where corresponding ISUP parame- ing information and the callee’s and caller’s identity, and
ters are translated into SIP headers. Consequently, lack of disguise traffic flow.
ISUP security can cause harm if embedded ISUPs are blindly
interpreted. Directly mapping SIP headers to ISUP parame- Threats Arising Due to Authenticated, but
ters may lead to SIP users accessing invalid or restricted num- Misbehaving Nodes
bers or selecting some carrier identification code that are
restricted by PSTN policy. Unlike a traditional PSTN phone, As stated above, SPs in an SS7 network are uniquely identi-
SIP user agents (UAs) may launch multiple simultaneous fied by their point codes, and IPSPs in IP networks are iden-
requests to occupy gateway ports as a prelude to a denial-of- tified by their IP addresses. In M2PA-based IPSPs, the
service attack. Many such vulnerabilities arising during ISUP- MTP3 layer is adapted to SCTP using the M2PA adaptation
to-SIP mapping have been discussed by Camarillo et al. [12]. layer in IP networks. MTP requires that each signaling node
Table 2 provides a comprehensive list of vulnerable parame- with a MTP3 layer be identified with a point code. Thus,
ters across various protocol layers of SS7 protocol stack and M2PA-based IPSPs have two identifiers, first their IP
SIGTRAN adaptation modules. addresses (i.e., as a SCTP-based multihomed host) and sec-
ond, their SS7 point code. In case of M3UA, SGs also have
Other Miscellaneous Threats a point code address. Now, a security threat arises if IP
addresses of a multihomed signaling node are not properly
Threats Arising Due to Eavesdropping bound with its corresponding point code. Although IPSPs
An intruder outside of the trust domain of an enterprise may run IPsec between them, and it authenticates two peers
network may monitor the flow of signaling traffic to gain based on IP addresses, not on their point codes. Conse-
information such as the nature of traffic, load, and network quently, it is possible that an authenticated IPSP may lie
topology besides the behavior and identity of subscribers. about its true point code to gain undue advantages, such as

38 IEEE Network • November/December 2006

DANTU LAYOUT 11/2/06 12:03 PM Page 39

Protocol layers Parameters of SS7 and SIGTRAN messages to be screened

• Validity of circuit identification code, allowed optional parameters, presence of all mandatory
parameters, permissible parameters and its value, and permissible message type
SS7 layer: ISUP
• SIGTRAN message type and its allowed parameters (validity of tag-length-value) (in case of M2PA,
user data field is screened)
SIGTRAN modules: M3UA,
Reasons: Misprovisioned switches may fail to parse and/or interpret parameters properly
M2PA
Security implementation: SG firewall checks syntax and semantics of messages, trust management,
and service level agreements — only allowed parameters and values are permissible

• Checking component portion, component type, operation code, parameter code, etc.
• Permissible parameters and their values, presence of all mandatory parameters
SS7 layer: TCAP • SIGTRAN message types and their allowed parameters (validity of tag-length-value)
Reasons: Switch may fail to parse and/or interpret parameters properly
SIGTRAN modules: mainly Messages may be used to control and regulate the switch, example: automatic code gap validity of
SUA request and response messages
Security implementation: SG firewall checks syntax and semantics of messages, trust management,
and service level agreements — only allowed parameters and values are permissible

• Calling and called party addresses, global title address, and translation type
• Affected point code, subsystem numbers (SSNs), etc.
SS7 layer: SCCP
• SIGTRAN message type and its allowed parameters (validity of tag-length-value)
Reasons: Switch may fail to parse and/or interpret parameters properly; routing depends on proper
SIGTRAN modules: mainly
addresses; SCCP management messages maintain subsystem of a node
SUA
Security implementation: SG firewall checks syntax and semantics of messages, trust management,
and service level agreement — only allowed parameters and values are permissible

• Permissible values in SIO, OPC, DPC fields of the signaling messages

• Permissible message type, H0/H1 code of network management messages
• SIGTRAN message type and its allowed parameters (validity of tag-length-value) (in case of M2PA,
SS7 layer: MTP3
user data field is screened)
Reasons: Switch may fail to parse and/or interpret parameters properly, spoofing OPC involves fraud,
SIGTRAN modules: M3UA,
network management messages control switch functions, because dynamic updating of routing table
M2PA
is possible at STPs
Security implementation: SG firewall checks syntax and semantics of messages, trust management,
and service level agreement — only allowed parameters and values are permissible

• Message Length field of M2PA message is consistent with the message’s actual length
SS7 layer: MTP2 • Similarly, LI field value of MTP2 and actual length of the message is consistent
• Consistency of ssequence numbers, FSN and BSN
SIGTRAN modules: M2PA Reasons: Inconsistent message construction
Security implementation: SG firewall

■ Table 2. Message content and structure screening at signaling gateways.

send signaling traffic posing as some other nodes, or start sending a link-status ready message to the peer node while
network management procedures posing as an authorized waiting for a link-status ready or link-status processor outage
node to send these network management messages. For message from the other side. Now suppose at the expira-
example, an M2PA node can send User Data messages with tion of T4 the remote M2PA node still continuously sends
spoofed OPC to another peer node, though the link between link-status proving messages without any ready message;
both nodes is secured with IPsec. then it exhibits an abnormal behavior.
Similarly, for a call-connection setup there is a prede-
Threats Arising Due to Violation of Protocol State fined sequence of messages to be exchanged between two
Machines signaling end points. For example, to set up a call, the
caller sends an initial address message (IAM) as a first
Exploits related to violation of protocol state machines message. In return, the callee sends address complete mes-
arise when a peer signaling node behave abnormally. For sage (ACM) and answer message (ANM) to indicate that
example, before an SCTP association (i.e., link) can be the called subscriber’s phone is ringing and is picked up,
opened to carry signaling traffic, the link alignment proce- respectively. At the end of the call, a release message
dure verifies its suitability as an SS7 signaling link. As part (REL) and a release complete message (RLC) are sent in
of the procedure, for a specified time, say T4 (≈ 8 s), link- that order to release the connection and free the resources
status proving messages are exchanged between two ends of held at the switch. For a particular voice trunk, if an SP or
the SCTP association and monitored for the transmission an IPSP sees an REL message without first seeing an IAM
errors at either end. This procedure of ensuring the suit- message, then this exchange of messages are considered as
ability of the link is referred to as proving. If both ends of a violation of the protocol state machine specification. Sim-
the link maintain their alignment for a period T4, they start ilarly, TCAP query and response messages should have a
sending link-status ready message to verify that both ends relationship between them, where a response message with-
have completed proving. In the case when one side is out any correlated request should be considered as an
aligned, then it starts a timer T1 (≈ 40 s) and continues abnormal behavior.

IEEE Network • November/December 2006 39

DANTU LAYOUT 11/2/06 12:03 PM Page 40

MTPSec and IPSec Enhanced firewall solution Intrusion detection

solution solution
(SG, MGC) and (MGC, MG) defines two proto-
Access
cols, Authentication Header (AH) and Encapsu-
control lating Security Payload (ESP), which essentially
provide security and confidentiality.
Abnormal
Integrity behavior
and + Syntax Content +
authentication screening screening and
anomalies
Proposed Security Solution
Securing intersignaling between PSTN and VoIP
Relationship requires addressing protocols that operate on
establishment
either side. On the VoIP, IP is the most domi-
nant network layer protocol and IPsec is the
most commonly recommended solution to pro-
vide security services in all of the SIGTRAN
■ Figure 6. Security services provided by the proposed solution (at the SG). adaptation layers. In the SS7 network, MTP3 is
the network layer protocol, which is devoid of
any network level security services. To fill the
Current Status of Telecommunication Security gaps, Sengar et al. [16] proposed MTPSec — an IPsec solution
for the MTP3 layer of the SS7 network, providing the same
Solutions security services irrespective of the differences in the proto-
cols and networks. Both sides of the interface thus provide
Telcordia’s Gateway Screening Specification authentication and integrity services to the signaling messages
The Telcordia specification [4] provides limited screening carried through.
capability, implemented at gateway STPs, to weed out inap- Another security threat arises due to misbehaving or
propriate and harmful ingress signals, referred to as gateway hijacked network entities. An incorrect signaling message (i.e.,
screening. Generally, gateway screening screens only message a message which does not satisfy a message’s syntax, the con-
headers, except if the message type is network management tent of the parameters, or its relationship with the previously
message, that is, then it checks the message content fields such exchanged messages) in the network, whether intentional or
as message type and affected destination parameters. Realizing accidental, could cause denial-of-service attacks and may even
the need for enhanced security measures, Telcordia later bring down a networking element. To avoid integrated signal-
incorporated screening ISUP and SCCP messages for specific ing network vulnerabilities, we propose a comprehensive lay-
message types and some message priority fields. Generally, ered security solution. Figure 6 shows three essential parts of
gateway screening checks the OPC and DPC of the messages our security solution. The enhanced firewall solution is imple-
to determine whether it should be allowed to enter through mented at the SG. Syntax screening allows only standard mes-
the ingress point of the network. Because this capability does sages to pass through, access control and content sscreening
not check the content of the other higher layer protocols of enforces the access control rules and checks for permissible
SS7 (such as ISUP, TCAP, etc.), the responsibility falls upon parameters and its values to pass through, thereby further
the SSPs, SCPs, and IPSPs (i.e., the nodes which have higher restricting syntactically allowed messages. Those messages
layer protocols) to do so. which have passed through both these screenings may still not
be correct if they are out of sequence. Relationship establish-
Other Academic and Industrial Work ment establishes a relationship between the exchanged mes-
On the academic side, in 1998, Sailer [13] proposed enhanc- sages and identifies the messages which are not part of the
ing existing network service interfaces by standardizing securi- regular call establishment process.
ty service interfaces at the application level to enable the Finally, the intrusion detection part of the proposed layered
provisioning of open security services. Lorenz et al. [14] and security implementation, monitors abnormal behavior at the
Moore et al. [15] analyzed the vulnerabilities in the SS7 net- protocol level. The protocol state machine is built from the
work and presented an attack taxonomy. Sengar et al. [16] specification, and is used to derive legitimate states and tran-
proposed MTPSec, a component at the MTP3 layer providing sitions. Our protocol state machine-based intrusion detection
link-by-link security in the SS7 network. can be considered as a variant of the anomaly-detection
On the industrial side, many recent commercial products mechanism, which classifies a deviation from legitimate state
are emerging to secure SS7. For example, the InteleGuard fire- transitions as a suspicious attack [21, 22].
wall [17] solution by Sevis Systems captures signaling mes-
sages directly from SS7 links, analyzes them based on policies
activated by service providers: filter, modify, monitor and/or
Conclusions
alert on specified SS7 signals. They go beyond traditional With the growing acceptance of the SIGTRAN protocol suite
gateway screening by having content-based filtering. Verizon’s for transporting SS7 signals across IP networks, there is a
SS7 Security Gatekeeper [18] provides a content and struc- need to secure both SS7 and IP networks. Still, most of the
ture-based firewall. Tekelec’s EAGLE STP gateway screening focus is on securing the public IP network, leaving SS7 net-
(GWS) [19] provides access control and screening of ingress work vulnerable and the signaling gateway virtually untouched.
and egress signals for MTP and SCCP. One reason for this disequilibrium may be the folklore that
the telephone network is secured enough and, consequently,
IETF’s Approach there are no threats. We argue the opposite, by showing some
IETF’s SIGTRAN working group has proposed IPsec and example exploits of fabricated messages or malicious
transport-layer security (TLS) for the security of signaling (hijacked) signaling nodes. Even misconfigured SGs, STPs,
messages traveling on SIGTRAN over SCTP links [20]. SS7 SSPs, and MGCs can generate spurious messages and conse-
signaling links still remain untouched by International quently affect other signaling nodes by shutting them down or
Telecommunication Union (ITU) and are devoid of any secu- by functioning erratically. To avoid such security problems, we
rity solutions. The IPsec security mechanism existing between propose MTPSec, IPsec, and enhanced firewall combined with

40 IEEE Network • November/December 2006

DANTU LAYOUT 11/2/06 12:03 PM Page 41

intrusion detection as a solution. MTPSec provides a much [21] R. Sekar et al., “Specification-Based Anomaly Detection: A New Approach
desired solution to the integrity and authenticity problem in for Detecting Network Intrusions,” ACM Comp. and Commun. Security Conf.
(CCS), Washington DC, Nov. 2002.
the SS7 network. [22] H. Sengar et al., “VoIP Intrusion Detection Through Interacting Protocol
State Machines,” IEEE Dependable Systems and Networks Conf. (DSN
References 2006), June 2006.
[1] L. Ong et al., RFC 2719: Framework Architecture for Signaling Transport,
IETF Network Working Group, Oct. 1999.
[2] FCC, Telecommunications Act of 1996, Report 110 Stat. 56, Pub. LA. no. Biographies
104–104, 1996. HEMANT SENGAR ([email protected]) is a Ph.D. student at George Mason Uni-
[3] J. G. van Bosse, Signaling in Telecommunication Networks, New York: versity, Fairfax, VA, in the Department of Information and Software Engineering.
Wiley, 1st edition, 1998. He received an M.S. degree from the same university and a B.Tech. degree from
[4] IPCC. Reference architecture, Technical report, International Packet Communi- Indian Institute of Technology, Kanpur. His current research interests are in the
cations Consortium, June 2002, www.packetcomm.org area of IP telephony and telecommunication networks security.
[5] C. Groves et al., RFC 3525: Gateway Control Protocol Version 1, IETF Net-
work Working Group, June 2003. R AM D ANTU ([email protected]) has 20 years of experience in the networking
[6] K. Morneault et al., RFC 3331: Signaling System 7 (SS7) Message Transfer industry, where he worked for Cisco, Nortel, Alcatel, and Fujitsu and was
Part 2 (MTP2): User Adaptation Layer. IETF Network Working Group, Sept. responsible for advanced technology products from concept to delivery. For
2002. the last five years, he has been researching in preventing DOS and spam
[7] T. George et al., RFC 4165: Signaling System 7 (SS7) Message Transfer Part attacks in VoIP networks. In recognition, he received five NSF awards during
2 (MTP2)-User Peer-to-Peer Adaptation Layer (M2PA). IETF Network Work- the past one year. He has co-chaired three workshops in VoIP security. He is
ing Group, Sept. 2005. currently an assistant professor in the Department of Computer Science and
[8] G. Sidebottom, K. Morneault, and J. Pastor-Balbas. RFC 3332: Signaling Engineering at the University of North Texas (UNT). His research focus is on
System 7 (SS7) Message Transfer Part 3 (MTP3) — User Adaptation Layer detecting spam, network security, and next generation networks. Prior to
(M3UA). IETF Network Working Group, Sept. 2002. UNT, he was Technology Director in Netrake where he was the architect of
[9] J. Loughney et al., RFC 3868: Signaling Connection Control Part User Adap- the redundancy mechanism for VOIP firewalls. His additional experience
tation Layer (SUA), IETF Network Working Group, Oct. 2004. includes Technical Director in IpMobile( acquired by Cisco) where he was
[10] GR-82-CORE, Signaling Transfer Point (STP) Generic Requirements, Techni- instrumental for the wireless/IP product concept, architecture, design and
cal report, Telcordia, Morristown, New Jersey, 2001. delivery. In addition to more than 50 research papers, he has authored sever-
[11] A. Vemuri and J. Peterson, RFC 3372: Session Initiation Protocol for Tele- al RFCs related to MPLS, SS7-over-IP, and Routing. Due to his innovative
phones (SIP-T) Context and Architectures, IETF Network Working Group, work, Cisco and Alcatel were granted a total of eight patents and another ten
Sept. 2002. are pending.
[12] G. Camarillo et al., RFC 3398: Integrated Services Digital Network (ISDN)
User Part (ISUP) to Session Initiation Protocol (SIP) Mapping. IETF Network D UMINDA W IJESEKERA ([email protected]) is an associate professor in the
Working Group, Dec. 2002. Department of Information and Software Engineering at George Mason Universi-
[13] R. Sailer, “Signaling and Service Interfaces for Separating Security Sensitive ty, Fairfax, VA. During various times, his research interests have been in securi-
Telecommunication Functions Considering Multilateral Security,” 6th Open ty, multimedia, networks, secure signaling (telecom, railway and SCADA),
Workshop on High Speed Networks, Stuttgart, Oct. 1997. avionics, missile systems, web and theoretical computer science. He holds cour-
[14] G. Lorenz et al., “Securing SS7 Telecommunications Networks,” Proc. 2001 tesy appointments at the Center for Secure Information Systems (CSIS) and the
IEEE Wksp. Info. Assurance and Security, West Point, NY, June 2001. Center for Command, Control and Coordination (C4I) at George Mason Univer-
[15] T. Moore et al., “Signaling System (SS7) Network Security,” 45th Midwest sity, and the Potomac Institute of Policy Studies in Arlington, VA. Prior to GMU
Symp. Circuits and Systems, vol. 3, Aug. 2002, pp. 496–99. he was at Honeywell Military Avionics, Army High Performance Research Center
[16] H. Sengar, D.Wijesekera, and S. Jajodia, “MTPSec: Customizable Secure at the University of Minnesota, and the University of Wisconsin. His doctorates
MTP3 Tunnels in the SS7 Network,” 19th Int’l. Parallel and Distributed Pro- are in Computer Science and Logic from the University of Minnesota and Cornell
cessing Symp. Wksp. 17, IPDPS, 2005. University in 1997 and 1990, respectively.
[17] SEVIS Systems, “InteleGuard Signaling Firewall,” White paper, 2001,
http://www.sevis.com/inteleguard.htm SUSHIL JAJODIA ([email protected]) is BDM International Professor of Information
[18] Verizon, “SS7 Security Gatekeeper,” Request for information, Verizon Com- Technology and director of Center for Secure Information Systems at George
munications, May 2002. Mason University, Fairfax, VA. He received a Ph.D. from the University of Ore-
[19] TEKELEC, “Tekelec EAGLE STP,” White paper, 2001, gon, Eugene, OR. His research interests include information security, temporal
http://www.tekelec.com/productportfolio/eagle5sas/ databases, and replicated databases. He has authored five books, edited 24
[20] J. Loughney, M. Tuexen, and J. Pastor-Balbas, “RFC 3788: Security Consid- books and conference proceedings, and published more than 300 technical
erations for Signaling Transport (SIGTRAN) Protocols, “IETF Network Work- papers in the refereed journals and conference proceedings. The URL for his web
ing Group, June 2004. page is http://csis.gmu.edu/faculty/jajodia.html

IEEE Network • November/December 2006 41