System and method for securing SS7 networks

• US 20050243799A1
• Filed: 04/20/2004
• Published: 11/03/2005
• Est. Priority Date: 04/20/2004
• Status: Abandoned Application

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Saaskilahti, Juha, Pekkala, Reijo, Wiren, Karl-Johan
• Application Number:
  US10/828,071
• Publication Number:
  US 20050243799A1
• Time in Patent Office: Days
• US Class Current: 370/352
• CPC Class Codes: H04L 12/2854 Wide area networks, e.g. public data networks

Abstract

A SS7 network component (e.g., Signaling Transfer Point (STP)) and a method are described herein which function to add a security parameter and if desired encrypt the user data in a traditional Signaling Connection Control Part (SCCP) message to create a secure SCCP message that can be safely transmitted through one or more transport SS7 networks to a destination SS7 network. The destination SS7 network has a SS7 network component (e.g., STP) that can function to transform the secure SCCP message back into the traditional SCCP message.

Claims

1. A Signaling System No. 7 (SS7) network component capable of adding a security parameter to a Signaling Connection Control Part (SCCP) message so as to create a secure SCCP message.

2. The SS7 network component of claim 1, wherein the secure SCCP message also includes encrypted data.

3. The SS7 network component of claim 1, wherein the security parameter includes the following fields:

protection options;

embedded management message indicator;

integrity checksum;

public land mobile network (PLMN) identity;

unitdata (UDT) to extended unitdata (XUDT) or long unitdata (LUDT) conversion indicator; and

message sequence number.

4. The SS7 network component of claim 3, wherein the protection options include:

no integrity protection and no encryption protection;

integrity protection and no encryption protection; and

integrity protection and encryption protection.

5. The SS7 network component of claim 1, wherein the SCCP message is an extended unitdata (XUDT) message or a long unitdata (LUDT) message.

6. The SS7 network component of claim 1, wherein if the SCCP message is a unitdata (UDT) message then that UDT message is converted into an extended unitdata (XUDT) message or a long unitdata (LUDT) message which is transformed into the secured SCCP message.

7. The SS7 network component of claim 1, wherein if the SCCP message is a SCCP management message then the SCCP management message is placed into a normal user data field of a new extended unitdata (XUDT) message or placed into a long data field of a new long unitdata (LUDT) message which is transformed into the secured SCCP message.

8. The SS7 network component of claim 1, wherein if the SCCP message is a key management message then the key management message is placed into a normal user data field of a new extended unitdata (XUDT) message or placed into a long data field of a new long unitdata (LUDT) message which is transformed into the secured SCCP message.

9. The SS7 network component of claim 1, wherein the SS7 network component is a Signaling Transfer Point (STP).

10. A method for protecting a Signaling Connection Control Part (SCCP) message so the SCCP message can be safely transmitted through at least one Signaling System No. 7 (SS7) network, said method comprising the step of:

transforming, at a SS7 network component, the SCCP message into a secure SCCP message.

11. The method of claim 10, wherein said step of transforming the SCCP message into the secure SCCP message includes:

adding a security parameter to the SCCP message.

12. The method of claim 11, wherein said step of transforming the SCCP message into the secure SCCP message further includes:

encrypting data in the SCCP message.

13. The method of claim 11, the security parameter includes the following fields:

protection options;

embedded management message indicator;

integrity checksum;

public land mobile network (PLMN) identity;

unitdata (UDT) to extended unitdata (XUDT) or long unitdata (LUDT) conversion indicator; and

message sequence number.

14. The method of claim 13, wherein the protection options include:

no integrity protection and no encryption protection;

integrity protection and no encryption protection; and

integrity protection and encryption protection.

15. The method of claim 10, wherein the SCCP message is an extended unitdata (XUDT) message or a long unitdata (LUDT) message.

16. The method of claim 10, wherein if the SCCP message is a unitdata (UDT) message then that UDT message is converted into an extended unitdata (XUDT) message or a long unitdata (LUDT) message which is transformed into the secured SCCP message.

17. The method of claim 10, wherein if the SCCP message is a SCCP management message then the SCCP management message is placed into a normal user data field of a new extended unitdata (XUDT) message or placed into a long data field of a new long unitdata (LUDT) message which is transformed into the secured SCCP message.

18. The method of claim 10, wherein if the SCCP message is a key management message then the key management message is placed into a normal user data field of a new extended unitdata (XUDT) message or placed into a long data field of a new long unitdata (LUDT) message which is transformed into the secured SCCP message.

19. A Signaling System No. 7 (SS7) network component capable of transforming a secure Signaling Connection Control Part (SCCP) SCCP message that was received into a SCCP message.

20. The SS7 network component of claim 19, wherein the secure SCCP message includes a security parameter which has the following fields:

protection options;

embedded management message indicator;

integrity checksum;

public land mobile network (PLMN) identity;

unitdata (UDT) to extended unitdata (XUDT) or long unitdata (LUDT) conversion indicator; and

message sequence number.

21. The SS7 network component of claim 20, wherein the protection options include:

no integrity protection and no encryption protection;

integrity protection and no encryption protection; and

integrity protection and encryption protection.

22. The SS7 network component of claim 19, wherein the secure SCCP message includes encrypted data.

23. The SS7 network component of claim 19, wherein the SCCP message is an extended unitdata (XUDT) message or a long unitdata (LUDT) message.

24. The SS7 network component of claim 19, wherein if the SCCP message is a unitdata (UDT) message then that UDT message was extracted from an extended unitdata (XUDT) message or a long unitdata (LUDT) message associated with the secure SCCP message.

25. The SS7 network component of claim 19, wherein if the SCCP message is a SCCP management message then that SCCP management message was extracted from a normal user data field of an extended unitdata (XUDT) message or extracted from a long data field of a long unitdata (LUDT) message associated with the secure SCCP message.

26. The SS7 network component of claim 19, wherein if the SCCP message is a key management message then that key management message was extracted from a normal user data field of an extended unitdata (XUDT) message or extracted from a long data field of a long unitdata (LUDT) message associated with the secure SCCP message.

27. The SS7 network component of claim 19, wherein the SS7 network component is a Signaling Transfer Point (STP).

28. A method for receiving a secure Signaling Connection Control Part (SCCP) message that was safely transmitted through at least one Signaling System No. 7 (SS7) network, said method comprising the step of:

transforming, at the SS7 network component, the received secure SCCP message into a SCCP message.

29. The method of claim 28, wherein the secure SCCP message includes a security parameter which has the following fields:

protection options;

embedded management message indicator;

integrity checksum;

public land mobile network (PLMN) identity;

unitdata (UDT) to extended unitdata (XUDT) or long unitdata (LUDT) conversion indicator; and

message sequence number.

30. The method of claim 29, wherein the protection options include:

no integrity protection and no encryption protection;

integrity protection and no encryption protection; and

integrity protection and encryption protection.

31. The method of claim 28, wherein the secure SCCP message includes encrypted data.

32. The method of claim 28, wherein the SCCP message is an extended unitdata (XUDT) message or a long unitdata (LUDT) message.

33. The method of claim 28, wherein if the SCCP message is a unitdata (UDT) message then that UDT message was extracted from an extended unitdata (XUDT) message or a long unitdata (LUDT) message associated with the secure SCCP message.

34. The method of claim 28, wherein if the SCCP message is a SCCP management message then that SCCP management message was extracted from a normal user data field of an extended unitdata (XUDT) message or extracted from a long data field of a long unitdata (LUDT) message associated with the secure SCCP message.

35. The method of claim 28, wherein if the SCCP message is a key management message then that key management message was extracted from a normal user data field of an extended unitdata (XUDT) message or extracted from a long data field of a long unitdata (LUDT) message associated with the secure SCCP message.