Signaling Firewall: How Telecom Networks Defend SS7, Diameter and SIP

Most telecom security incidents do not begin with a breached server. They begin with a signaling message that looked ordinary.

A roaming partner queries the HLR for a subscriber's location. A Diameter request arrives with a slightly unusual realm. An SMS routing lookup comes in from a network that has no obvious reason to send one. Each of these is a normal operation somewhere in the world. The difference between routine traffic and an attack is often nothing more than context: who sent it, whether they should have, and how many times they have done it in the last hour.

That is the problem a signaling firewall exists to solve. It is not a general purpose security appliance bolted onto a telecom network. It is a control layer that understands SS7, Diameter, SIP and now HTTP/2, and can tell the difference between a legitimate interconnect operation and one that is being used to track a subscriber, intercept an OTP or reroute a call.

For network architects and telecom security teams working across 5G, IoT and increasingly API-driven core networks, signaling security has moved from a specialist concern to a foundational one.

What is a Signaling Firewall?

A signaling firewall is a security layer that protects telecom signaling protocols such as SS7, Diameter, SIP and HTTP/2. These protocols are the traffic controllers for voice calls, SMS and mobile data sessions. They tell the network where a subscriber is, which switch should handle a call, and how a message should be routed between operators.

Unlike a traditional firewall that filters IP packets by address and port, a signaling firewall parses the signaling message itself. It reads the operation code, the parameters, the originating global title or realm, and decides whether that specific operation is permitted from that specific peer at that specific moment.

Its core functions fall into three areas. It detects threats such as spoofed location requests, SMS hijacking and unauthorized call rerouting. It validates traffic, confirming that messages originate from trusted and commercially agreed sources. And it supports compliance, producing the audit trail operators need to demonstrate that subscriber data is protected under frameworks such as GDPR.

A practical example: an attacker with SS7 access sends a SendRoutingInfoForSM query to locate a target subscriber, then follows it with an UpdateLocation to redirect that subscriber's SMS to a controlled node. The goal is to intercept banking OTPs. A signaling firewall blocks the sequence, either because the querying network has no roaming agreement, because the subscriber was located in a different country seconds earlier, or because the operation itself is one that peer is never authorized to perform.

For more on telecom compliance, explore our guide to compliance in SMS marketing, and our global SMS compliance guide for market-by-market requirements.

Why Signaling Firewalls Matter

Signaling protocols were designed decades ago for a closed club of state-owned operators who trusted each other by default. SS7 has no authentication and no encryption. Diameter added structure but inherited the same trust assumptions. The network was safe because access to it was hard to get.

That assumption collapsed. Interconnect access is now available through hundreds of operators, resellers, IPX providers and MVNOs across every jurisdiction. Access can be leased, borrowed or simply bought from a small operator with weak controls. Once inside, an attacker is treated as a peer.

The consequences fall into three categories:

Subscriber privacy. Location tracking and communication interception, sometimes at the request of commercial surveillance vendors rather than criminals.

Service availability. Signaling storms and targeted denial of service against HLR, HSS or IMS nodes, which can take down service for large subscriber groups.

Revenue. SMS bypass, call hijacking, interconnect fraud and inflated traffic schemes that shift money away from the operator.

Regional picture

Signaling security has become a regulatory topic, not just a technical one, and the emphasis differs by market.

In the United States, SS7 vulnerabilities have received sustained attention from the FCC and from congressional inquiries, particularly around the interception of communications belonging to public figures. In the United Kingdom, the National Cyber Security Centre and Ofcom have raised telecom protocol risk within the wider Telecommunications Security Act framework. In India, TRAI and the Department of Telecommunications have pushed operators toward tighter controls at interconnect exchanges, alongside sender ID and template registration regimes for messaging compliance. Across the Gulf states, regulators have moved quickly on both signaling security and A2P messaging control, often making firewall deployment a condition of interconnect approval. In Australia, operators have invested in signaling analytics and threat intelligence sharing.

The GSMA has published the FS series of documents (FS.07, FS.11, FS.19 and related) that define signaling security categories and recommended filtering. These are the practical baseline most signaling firewall features are built against, and they are the right reference point when evaluating a vendor.

How a Signaling Firewall Works

A signaling firewall applies a layered defense, and the mechanisms differ by protocol.

SS7 firewall functionality

An SS7 firewall intercepts MAP, ISUP, CAP and SCCP messages at the interconnect. It validates each one against a ruleset that is usually organized in three categories, following GSMA guidance.

Category 1 covers messages that should never arrive from outside the home network at all, such as SendIdentification or unauthorized AnyTimeInterrogation. These are blocked outright.

Category 2 covers messages that are legitimate only from a network where the subscriber is currently roaming. Enforcement requires the firewall to correlate against known roaming state, which is why velocity checking and location plausibility matter.

Category 3 covers messages that are legitimate in normal roaming but can be abused, such as certain ProvideSubscriberInfo or InsertSubscriberData operations. These require behavioral analysis rather than a simple allow or deny rule.

The correlation piece is what separates a real SS7 firewall from a packet filter. If a subscriber registers in Germany and a location query for the same subscriber arrives from a network in another region ninety seconds later, no single message is invalid. The sequence is.

Diameter firewall capabilities

Diameter carries signaling for LTE and for interworking with 5G. A Diameter firewall protects against AVP manipulation, where attributes inside a message are forged or injected, and against realm-based attacks where the origin realm does not match the actual source of the traffic.

Controls typically include origin-realm and origin-host validation against the roaming agreement database, AVP structure and value checking, rate limiting per peer and per subscriber, and transport protection through IPsec or TLS on the Diameter Edge Agent. Many Diameter attacks are simply SS7 spoofing techniques translated into a newer protocol, so detection logic often mirrors the SS7 category model.

SIP firewall actions

SIP secures VoIP, VoLTE and IMS services. A SIP firewall filters malformed or malicious INVITE, REGISTER and OPTIONS messages, and defends against registration hijacking, toll fraud through unauthorized call setup, and flooding attacks that exhaust IMS resources. Rate limiting on REGISTER attempts and validation of the relationship between the From header, the P-Asserted-Identity and the authenticated subscriber are the common controls.

HTTP/2 and the 5G service based architecture

In 5G Standalone, signaling moves to HTTP/2 REST APIs between network functions, mediated by the Service Communication Proxy and, for roaming, the Security Edge Protection Proxy. The protocol is modern and encrypted, which removes some old problems and introduces new ones. This is the same shift reshaping messaging infrastructure under 5G. Attacks shift toward API abuse: malformed JSON payloads, token replay, over-permissive OAuth scopes, and network function impersonation.

A firewall built only for SS7 does nothing here. Operators running hybrid networks, which is nearly all of them, need correlation across all four protocol layers, because an attacker who is blocked on Diameter will simply retry the same objective through SS7 fallback or through the 5G interface.

System architecture

Deployment usually takes one of two forms. Inline deployment places the firewall between signaling gateways and core nodes so it can block in real time. Out-of-band monitoring uses probes to analyze a copy of the traffic passively, which removes any latency or availability risk but cannot stop an attack in progress.

Most operators begin out-of-band to build a baseline and measure false positives, then move critical rules inline once they trust the ruleset. AI and machine learning layers are increasingly added on top, not to replace rules but to flag sequences that no rule anticipated.

What Signaling Attacks Actually Look Like

The threat categories are worth naming, because they are what a firewall ruleset is ultimately measured against.

Location tracking. Repeated AnyTimeInterrogation or ProvideSubscriberInfo queries return cell-level location. Commercial surveillance operations have used this at scale.

SMS interception. UpdateLocation is used to register the subscriber to an attacker-controlled node, so inbound SMS including banking OTPs is delivered to the attacker rather than the handset. This is the mechanism behind a large share of SS7-enabled account takeover, and the reason operators invest in stopping OTP fraud at the signaling layer.

Call interception and redirection. Manipulation of ISUP or of the roaming profile allows calls to be rerouted through a node the attacker controls.

Subscriber data theft. SendIdentification and related operations expose IMSI, authentication vectors and subscriber profile data. IMSI disclosure is often the first step in a longer attack chain.

Denial of service. Signaling floods against HLR, HSS or IMS nodes degrade or disable service. This can be deliberate or a side effect of misconfigured equipment somewhere in the interconnect.

SIM swap and account takeover support. Signaling data makes social engineering against a carrier's own support process far more convincing. See our SIM swap fraud detection guide and the CAMARA SIM Swap API for the detection side.

SMS pumping and artificially inflated traffic (AIT). Automated systems trigger large volumes of OTP requests to premium destinations, generating revenue for the fraudster while the enterprise pays for messages no human ever requested.

Regional Use Case: Tackling SMS Pumping

Almuqeet Systems deployed its signaling firewall for an operator facing sustained SMS pumping, a fraud pattern where attackers flood enterprise signup and verification forms with automated OTP requests. The traffic is technically valid at every individual step, which is what makes it difficult to stop with content filtering alone.

The approach combined SMPP-level validation of binding sources with behavioral analysis at the signaling layer: destination range concentration, request velocity per source, and the conversion gap between OTP requests issued and verifications actually completed. Legitimate OTP traffic converts at a high rate. Pumped traffic almost never does. The same behavioral signals feed a wider telecom fraud management programme.

Filtering invalid SMPP connections and applying velocity thresholds reduced fraudulent traffic substantially within the first quarter of operation, and gave the operator per-route reporting they could take to the aggregators concerned. The reporting mattered as much as the blocking, because bypass and pumping disputes are commercial conversations that require evidence.

Common challenges and how firewalls address them

Signaling firewalls are not simple to run well, and the difficulties are usually organizational as much as technical.

Protocol complexity. A single subscriber transaction can touch SS7, Diameter, SIP and HTTP/2. Rules written in isolation per protocol leave gaps at the boundaries. Cross-protocol correlation engines address this by tracking subscriber state across layers rather than per interface.

Roaming agreements. Blocking a partner's traffic is a commercial decision. Enforcement without evidence damages relationships, and enforcement without exception handling breaks legitimate roaming for real customers. Good platforms maintain a roaming agreement database that drives policy automatically and produce the reporting needed for partner discussions.

False positives. A blocked legitimate operation can mean a customer who cannot receive calls while abroad. This is why most deployments run in monitor mode first, and why the speed of releasing a wrongly blocked peer matters more than headline detection rates.

Rule maintenance. Attack techniques change faster than internal security teams can write rules. Threat intelligence feeds and shared industry indicators keep rulesets current, but someone has to own the process.

Legacy protocol limits. SS7 cannot be retrofitted with authentication. The firewall is a compensating control, not a fix, and it will remain one for as long as SS7 carries roaming traffic.

Scale. 5G signaling volumes are an order of magnitude higher than LTE. Cloud native firewalls with horizontal auto-scaling have largely replaced fixed-capacity appliances for this reason, and many operators pair them with managed NOC services rather than staffing 24/7 monitoring internally.

What to look for when evaluating a Signaling Firewall

Detection coverage is the obvious criterion. Several less obvious ones matter more in production.

•       Protocol breadth. Does it cover SS7, Diameter, SIP and HTTP/2, and does it correlate across them or treat each separately?

•       GSMA FS alignment. Ask which FS documents the ruleset implements and how quickly new categories are adopted.

•       Latency at peak. Inline inspection adds delay to every transaction. Measure at peak throughput, not average.

•       Failure mode. If the firewall fails, does signaling stop or pass unfiltered? Both are defensible, but choose deliberately rather than discovering the answer during an outage.

•       Rule authorship. Can your own team write and test rules, or does every change require the vendor?

•       Reporting. Security teams need alerts. Commercial teams need traffic classified by route and partner. A platform that serves only one of those two audiences gets underused.

•       Deployment model. On-premises for data residency control, or managed service for lower upfront cost and vendor-run rule maintenance.

The future of signaling security in 5G and beyond

5G Standalone changes the shape of the problem. Service based architecture means network functions talk over HTTP/2 APIs, and the security question becomes an API security question: authentication between network functions, OAuth scope management, SEPP configuration for roaming, and protection against impersonation of a network function.

Three directions are shaping vendor roadmaps. Cloud native deployment, so firewall capacity scales with signaling load rather than being provisioned for peak. Zero trust principles applied to the interconnect, where no peer is trusted by default regardless of roaming agreement status. And cross-domain correlation, linking signaling anomalies with fraud management and messaging firewall data, because an SS7 location query and a suspicious SMS route are frequently part of the same operation.

Network APIs exposed to enterprises through initiatives like CAMARA add another surface. When an enterprise can query device location or verify a number through an API, the authorization model behind that API becomes part of the signaling security perimeter.

SS7 is not going away soon. Roaming interworking will keep legacy protocols alive well past the point where the core network has moved on, which means operators will run multi-protocol defenses for years rather than migrating away from the problem.

FAQs About Signaling Firewalls

Conclusion

Signaling security is the layer most telecom attacks pass through and the layer fewest people outside the industry ever see. SS7 will keep carrying roaming traffic. Diameter will keep serving LTE. SIP will keep handling voice, all of it riding on SS7 and SMSC infrastructure. And 5G adds an API surface on top of all three rather than replacing them.

A signaling firewall is what makes that stack governable: multi-protocol, behavior-aware, and able to produce evidence when a partner's traffic has to be challenged. For operators building infrastructure meant to last, it belongs in the core architecture rather than in the security backlog.

To review your own signaling exposure or discuss a deployment, talk to the Almuqeet Systems team.