Signalling System No. 7 (SS7) is an old signaling protocol, but all mobile network operators still use it to exchange information between nodes in the network nationally and internationally. Security and SS7 can’t come together, so I started explaining the definition of SS7 in a series that began with this video.
Once you finish the video, you can conclude that one of the main vulnerabilities in the SS7 domain is “GT Leasing, ” a common term for gaining access to the global SS7 network and exchanging signaling messages. However, I got some messages asking what GT is. So I am writing this article to explain GT or Global Title and why we need it.
What is Global Title (GT)?
A Global Title (GT) is an address used for routing signaling messages (using the signaling connection Control Part / SCCP protocol), which I will explain later, on telecommunications networks. National authorities allocate numbering resources to communications providers, which reserve and use part of those numbers as GTs.
In mobile networks, GTs enable information to be exchanged within and between networks, so that mobile services work regardless of whether a user is in his/her home network or roaming.
Why do we need the GT?
As the lower transfer layers use only Point Codes (PC) to transfer the messages between nodes, you have to allocate a lot of Point Codes for the communication and messages exchange which is hard but why?
Telecommunication networks are vast and complex, with multiple nodes like switches, databases, and application servers. Directly using physical addresses (like Point Codes) for routing would require every network element to know all others, which is impractical. So GT acts as a logical address (e.g., a phone number or IMSI) that hides the physical details of network nodes. This abstraction simplifies routing and allows networks to evolve without disrupting operations.
GT enables signaling messages to be routed between networks seamlessly by translating the logical GT into physical routing information (e.g., Point Code and Subsystem Number). It supports Subsystem Numbers (SSNs), which identify specific services at a destination node, ensuring messages reach the correct application (e.g., HLR for subscriber data, SMSC for messaging).
Also, GT allows dynamic translation via Global Title Translation (GTT), ensuring messages are routed correctly even when the physical location of a subscriber or service changes.
Point codes range from 0.0.0 to 7.255.7 (14 bits), The problem with the ITU International Signaling Point Codes is that they too, are a limited resource with only 16,383 possible ISPCs. So GT fixes this by using the SCCP Address as I will explain below.
Now you can ask What is SCCP Protocol?
First, you have to review the SS7 article, then back to understand SCCP or if you’re familiar with SS7 protocol. Please bring your coffee and let’s start 🙂
SCCP (Signaling Connection Control Part): This layer is responsible for the routing and addressing of messages between the nodes in the SS7 network. It uses global titles, point codes, and subsystem numbers to identify the nodes and the services they provide. It also supports connectionless and connection-oriented modes of communication.
SCCP Addressing
SCCP enables an S7 to route MAP messages. Routing is always based on addresses. SCCP uses the following addresses:
- Calling address — identifies call origination.
- Called address — identifies call destination.
SCCP addressing is very flexible and makes use of three separate elements:
- Destination Point Code (DPC): is the label of an SS7 signaling message that uniquely identifies the destination point of the message in a signaling network.
- Global Title (GT): looks like an E.164 formatted phone number, and often it is just that.
- SubSystem Numbers (SSN): is the type of system we want to reach, ie an HLR, MSC, CAMEL Gateway, etc.
Where:
- NA = Nature of Address: NA indicates if the address is national or international.
- 3 – National
- 4 – International
- AI = Address Information: This is an address according to the numbering plan indicated.
- SSN = SCCP Subsystem Number: The terminating node examines the SSN to identify the concerned user (node).
- 6 HLR
- 7 VLR
- 8 GMSC, MSC
- 9 EIR
- 10 AUC
- 12 SC
- 222 BSC (BSSAP) in case of ANSI signaling (GSM 1900)
- 224 HLR-R (HLR Redundancy)
- 254 BSC (BSSAP) in case of CCITT signaling (GSM 900)
- 3 ISUP (if ISUP uses SCCP)
- NP = Numbering Plan: indicates the numbering scheme from which the address originates:
- 1 – ISDN/Telephony Numbering Plan (E.163/E.164) e.g. MSISDN, GT address
- 7 – ISDN/Mobile Numbering Plan (E.214) e.g. IMSI, MGT (Location Updating)
-
Translation Type (TT): A GT requires a translation function. The TT directs the message to the appropriate Global Title (GT) translation.
The Address Information (AI) can be translated into different values for different combinations of DPCs, SSNs, and GTs.- 0 CCITT signaling
- 9 ANSI signaling
- 1-8 Used for the Service Center (SC) interface
- 10-254 MTS exchange property SMSFMOSMTRTYPE
GT Use Cases
- Mobile Roaming: A subscriber roaming abroad uses their home network’s GT to retrieve account details from the HLR in their home country.
- SMS Routing: An SMS sent to a subscriber’s phone number (E.164 GT) is routed to their current network and delivered, even if they are roaming.
- Number Portability: When a subscriber changes operators but keeps their phone number, GT ensures messages are routed to the new operator.
Summary
The Global Title is a cornerstone of SS7 because it provides:
- Abstraction, flexibility, scalability, and standardization.
- Efficient and seamless routing for telecommunications services like voice calls, SMS, and roaming.