From SS7 to Diameter and HTTP/2 in Modern Signaling Networks
Signaling has evolved from circuit-switched roots to cloud-native architectures, reshaping how voice, data, and control messages move across continents. Engineers in Sydney and Melbourne who once managed TDM links now design RESTful interfaces running on HTTP/2. The path from SS7 to Diameter to HTTP/2 reflects three decades of architectural reinvention driven by mobile data growth and IP convergence.
Each generation brought new capabilities and new risks. SS7 delivered reliable call setup across the PSTN; SIGTRAN carried its messages over IP; Diameter handled policy and charging in LTE; and HTTP/2 underpins the service-based interfaces of the 5G core. Understanding this chain is essential for anyone securing or operating modern mobile networks in Australia and beyond.
SS7 Foundations in the PSTN Era
SS7 emerged in the 1970s as a common-channel out-of-band signaling system for the public switched telephone network. In Australia, Telecom Australia deployed SS7 throughout the 1980s and 1990s to interconnect exchanges from Perth to Brisbane. The protocol stack separated physical transmission, link-level reliability (MTP2), network functions (MTP3), and user parts such as ISUP for voice and TCAP for database queries like number translation and calling name presentation.
The strength of SS7 was its deterministic performance. Fixed-bandwidth 64 kbit/s links carried call setup messages with predictable delay, allowing operators like Telstra and Optus to engineer trunk groups with confidence. The trade-off was limited scalability and an implicit trust model where every participant in the global SS7 network was assumed to be a legitimate operator, an assumption that later proved costly.
SIGTRAN as the Bridge to IP
As Australian operators expanded 2G and 3G coverage through the early 2000s, the cost of separate signaling and bearer networks became untenable. SIGTRAN, defined by the IETF in RFC 2719 and related documents, transported SS7 user parts over IP using SCTP as the underlying transport. Adapters such as M2UA, M3UA, and SUA allowed legacy switches and mobile switching centres to communicate without dedicated TDM circuits.
This shift laid the groundwork for operator consolidation. A single IP/MPLS backbone in Sydney could now carry SIGTRAN between core sites, reducing leased-line costs. Engineers who had spent years tuning MTP3 timers had to learn path management and congestion handling across SCTP associations.
Diameter and the 4G Evolution
The 3GPP specifications for LTE required a signaling protocol that could carry authentication, policy, and charging information across packet-switched domains. Diameter, defined in RFC 6733, was chosen because it inherited SS7's request-response structure while operating natively over SCTP or TCP. Interfaces such as S6a, Gx, and Rx became the backbone of every 4G core, and the ACMA's guidance on lawful interception applies directly to how Diameter routing agents are deployed and audited.
The differences across the four protocol generations that have shaped modern signaling are summarised below.
| Feature | SS7 | SIGTRAN | Diameter | HTTP/2 (5G SBA) |
|---|---|---|---|---|
| Underlying transport | TDM (E1/T1) | IP/SCTP | IP/SCTP or TCP | IP/TCP/TLS |
| Message format | Binary, fixed | Encapsulated SS7 | Binary AVPs | Binary frames, JSON/Protobuf |
| Primary use | PSTN call setup, ISUP | Mobile core backhaul | Policy, charging, mobility | Service-based API calls |
| Trust model | Global implicit trust | Operator-managed trust | Operator + roaming agreements | Zero-trust, OAuth2, mTLS |
| Typical deployment | Per-link | Per-association | Per-realm | Per-service mesh |
For Australian operators, Diameter meant new routing agents and interconnects for international roaming partners. The shift from per-link engineering to per-realm routing required new skills in capacity planning and Diameter application-level state machines.
HTTP/2 and the 5G Service-Based Architecture
5G abandoned the monolithic Diameter approach for a service-based architecture where network functions expose REST APIs. HTTP/2, with its binary framing and multiplexing, became the default transport inside the 5G core. Functions such as NRF, AMF, and SMF communicate using OpenAPI-defined services over TLS, and orchestration increasingly relies on Kubernetes.
This change moves signaling design closer to cloud-native engineering. Engineers working on Open RAN pilots in Adelaide now design with Helm charts and OAuth2 tokens rather than SCCP subsystem numbers. The conceptual shift from connection-oriented to stateless request-response mirrors what web developers have practiced for years, opening the field to a broader talent pool.
Security Lessons Across the Generations
SS7 vulnerabilities revealed in the 2010s showed how location tracking and SMS interception were possible from anywhere in the global signaling network. Australia responded through amendments to the Telecommunications (Interception and Access) Act and operator-level firewalls that screen SS7 and Diameter signaling at the network edge, especially for inbound roamers landing in Brisbane or Perth.
With 5G, the SBA model introduces fresh concerns such as API endpoint discovery, token theft, and service mesh misconfiguration. The Australian Cyber Security Centre has flagged mobile network security in its annual threat reports, encouraging zero-trust designs and continuous monitoring of internal APIs. Each protocol generation has taught engineers that architectural assumptions, not just code, define real security posture.
Building Skills Across the Stack
Transitioning between SS7, Diameter, and HTTP/2 requires hands-on familiarity with packet captures, trace analysis, and protocol state machines. Building a lab environment with simulated HLR, PCRF, and NRF instances gives practitioners a safe space to test edge cases. Reading call flows alongside the relevant 3GPP or IETF specification deepens intuition about timer behaviour and failure recovery.
Engineers moving into 5G should consider the following skills to develop:
- Capture live signalling traffic with Wireshark where SIGTRAN and Diameter coexist with current monitoring
- Read 3GPP TS 23.501 alongside OpenAPI definitions for AMF and SMF services
- Map ACMA and ACSC guidance to concrete firewall rules at the Diameter and NRF edges
- Practise SCTP association failover scenarios in a lab before they occur in production
- Review OAuth2 scope design for network-exposed APIs to prevent lateral movement
- Study historical SS7 incidents to recognise similar design flaws in modern interfaces
For a structured walk-through of MTP3, ISUP, SCTP, and SBA fundamentals in sequence, the SS7 Training curriculum is a good starting point, especially for engineers transitioning from TDM backgrounds to IP-native cores.
A practical next step is to set up a small lab this week with one SIGTRAN node, one Diameter agent, and one 5G service consumer, then trace a single subscriber attachment from 4G to 5G. Seeing the protocol hand-off in a single capture turns the theory in this article into a repeatable operational skill.
