Fact-checked by Grok 2 weeks ago

Mobile Application Part

The Mobile Application Part () is an SS7-based standardized by for use in , , , and through interworking mobile networks, enabling signaling communication between core network entities to manage subscriber , , call , and supplementary services. It operates atop the Transaction Capabilities Application Part (TCAP) and Signaling Connection Control Part (SCCP) layers of the SS7 , facilitating the exchange of PLMN-specific information such as updates, roaming numbers, and short message transfers. Defined in 3GPP TS 29.002, MAP supports a range of application contexts tailored to specific operations, ensuring across public land mobile networks (PLMNs). MAP's core purpose is to support essential network functions, including procedures like updating and control between Mobile Switching Centers (MSCs), as well as subscriber handling via interactions with the Home Location Register (HLR) and Visitor Location Register (VLR). Key entities involved include the Serving GPRS Support Node (SGSN) for packet-switched services, the Equipment Identity Register (EIR) for device authentication, and the Gateway Mobile Location Center (GMLC) for location-based services. It provides operations for short message service () relay, such as forwarding mobile-originated messages to SMS centers, and supplementary services like and barring through registration and interrogation primitives. Error handling, dialogue management, and fault recovery mechanisms, including restoration after failures, further enhance its reliability in fault-tolerant environments. Originally developed for second-generation () GSM networks, MAP has evolved through 3GPP releases to accommodate third-generation () UMTS enhancements, such as improved security with authentication quintuplets, and fourth-generation () LTE interworking via entities like the Mobility Management Entity (MME). While SS7 remains its primary transport, adaptations allow limited use over IP in hybrid networks, with MAP retained for interworking in 5G networks that use service-based interfaces over in the core architecture. This protocol's robustness has made it a of global mobile roaming and service provisioning in and transitional systems.

Overview

Definition and Role

The Mobile Application Part (MAP) is an SS7 application layer protocol suite designed to deliver mobile services within GSM, UMTS, and LTE (EPS) core networks. It provides the signaling framework for transferring (PLMN)-specific information, particularly for roaming mobile stations, using the (SS7). MAP plays a central role in facilitating communication between core network elements, including the Home Location Register (HLR), Visitor Location Register (VLR), Mobile Switching Center (MSC), Equipment Identity Register (EIR), Authentication Center (AuC), Short Message Service Center (SMS-C), Serving GPRS Support Node (SGSN), and Mobility Management Entity (MME). These interactions ensure coordinated operations across the network, such as updating subscriber locations and verifying device identities during handovers or attachments. The primary purpose of is to support user mobility, , and service provisioning in both circuit-switched and packet-switched domains. For instance, it handles location updates to track subscriber positions and procedures to secure access, while also enabling the insertion of subscriber data for personalized services like short messaging. In the SS7 protocol stack, is positioned above the Transaction Capabilities Application Part (TCAP) to enable transaction-oriented messaging for reliable and structured exchanges between network nodes. This layering allows to focus on application-level mobile-specific operations while relying on underlying SS7 components for transport.

Historical Development

The development of the Mobile Application Part (MAP) began in the late 1980s as a key component of the (GSM) standardization effort led by the (ETSI) and supported by the GSM (MoU), which later evolved into the . This work drew influence from (ISDN) signaling protocols and early European mobile projects in the 1980s, such as those under the Conference of European Posts and Telecommunications (CEPT), to enable core network functions for digital cellular systems. MAP was initially specified in 1991 as part of GSM Phase 1, providing the application-layer protocol for mobility management and call control over the Signaling System No. 7 (SS7) transport. The protocol evolved through GSM Phase 2, finalized in 1995, and Phase 2+, which introduced enhancements including Short Message Service (SMS) support in Phase 1 and General Packet Radio Service (GPRS) integration later. A key milestone was the first commercial GSM launch on July 1, 1991, in Finland by Radiolinja, which utilized MAP for network operations. In parallel to GSM MAP, the ANSI-41 standard was developed in starting in 1984 by the (TIA) for intersystem operations in TDMA (IS-136) and CDMA (IS-95) networks, with its initial version (IS-41 Revision 0) published in 1988. In 1998, ETSI's GSM work transitioned to the (3GPP), established in December of that year, to integrate MAP into Universal Mobile Telecommunications System (UMTS) as a backward-compatible for 2G/3G interworking. This ensured continuity for and signaling across generations.

Technical Specifications

Published Standards

The Mobile Application Part (MAP) was initially specified in the original Global System for Mobile Communications () standards through 3GPP Technical Specification (TS) 09.02, which covered versions 1 through 7 during the 1990s and addressed Phase 1 through Phase 2+ requirements for core network signaling. These early specifications, developed under the (), defined the basic MAP protocols for and call handling in circuit-switched networks. With the transition to and further enhancements, the specifications were unified and evolved into TS 29.002 starting from Release 99 in 1999, incorporating extensions for Customised Applications for Mobile networks Enhanced Logic () Phase 3 and (GPRS) support to enable advanced service control and packet data mobility. TS 29.002 has been maintained under 's global harmonization efforts since 2000, when transferred primary responsibility for / specifications to the partnership of seven regional standards development organizations, ensuring worldwide for in networks. The specification continues to be updated for legacy support and interworking, with the latest version V18.0.0 (Release 18) published in May 2024. In parallel, the North American variant of originated with IS-41 (also known as TIA/EIA-41), a standard developed by the (TIA) for analog and digital cellular systems based on the IS-95 cdmaOne air interface. This evolved into 3GPP2 specifications, with 3GPP2—formed in 1999 as a counterpart to for cdma2000 and competing UMTS technologies—maintaining MAP under X.S0004 from 2004 onward, with updates through version 2.0 in 2007 and further revisions to support intersystem operations in 3G cdma2000 networks. Key evolutions in standards include the addition of location services in Release 4 (2001), which introduced procedures for mobile-terminated and mobile-originated location requests to support emergency and value-added services via enhanced MAP operations. Later releases, starting from Release 5 (2002), provided hints for integration with the (IMS) through work items enabling CAMEL-like control over IMS sessions and alignment of MAP with SIP-based signaling for multimedia services.

Protocol Architecture

The Mobile Application Part (MAP) operates as an application-layer protocol within the Signaling System No. 7 (SS7) framework, utilizing the services provided by the Transaction Capabilities Application Part (TCAP) to manage remote operations. TCAP, in turn, relies on the Signaling Connection Control Part (SCCP) for connection-oriented or connectionless transport, which is supported by the Message Transfer Part (MTP) layers (MTP3 for routing, MTP2 for link layer, and MTP1 for physical transmission) in the traditional SS7 stack. This layered architecture enables MAP to exchange signaling messages between network entities such as the Home Location Register (HLR), Visitor Location Register (VLR), and Mobile Switching Center (MSC) without direct handling of lower-layer concerns. MAP messages are encoded using Abstract Syntax Notation One (ASN.1) with Basic Encoding Rules (BER), as defined in ITU-T Recommendations X.680 and , to ensure across diverse network implementations. These messages are structured as TCAP components, including invoke (to request an operation), return result (to convey successful outcomes), return error (to indicate failures), and reject (for protocol errors). Error handling is integrated through dedicated error components that specify the nature of the issue, allowing the receiving entity to respond appropriately. Dialogue handling in MAP is facilitated by TCAP, which supports structured transactions involving multiple related messages, such as a sequence of invokes and results within a single dialogue. This enables complex interactions, like location updates, to be coordinated atomically, with TCAP managing dialogue identifiers and termination conditions to maintain state across exchanges. For transport, MAP traditionally employs dedicated SS7 links for reliable delivery in circuit-switched environments, but it also supports IP-based alternatives through the SIGTRAN protocol suite, particularly the M3UA (MTP3 User Adaptation Layer) protocol, which adapts SCCP messages over (SCTP) for IP networks. This hybrid capability allows MAP to function in modern converged architectures without altering the upper-layer logic. Core components of include operation codes that identify specific procedures, such as UPDATE_LOCATION (opcode 2) for registering a mobile station's location with the HLR. Error codes provide standardized failure indications, for example, system failure (code 34) signaling internal processing errors at the receiving node. Parameter structures, encoded in , include essential identifiers like the (IMSI) for unique subscriber recognition and the Mobile Station International Subscriber Directory Number () for routing calls and messages.

Facilities and Services

Mobility Management

Mobility management in the Mobile Application Part (MAP) encompasses procedures for tracking subscriber locations, supporting across networks, and recovering from faults to ensure continuous service availability in , , and EPS environments. These operations primarily involve interactions between the Home Location Register (HLR), Visitor Location Register (VLR), Mobile Switching Center (MSC), Serving GPRS Support Node (SGSN), and Authentication Center (), using MAP messages transported over the Signaling Connection Control Part (SCCP). Location management procedures maintain accurate records of subscriber positions to enable efficient paging and service delivery. The UPDATE_LOCATION operation is initiated by the VLR, MSC, or SGSN when a mobile station (MS) registers in a new location area, routing area, or tracking area, providing the HLR with the subscriber's International Mobile Subscriber Identity (IMSI) and the serving entity's address for updates. The HLR responds by inserting subscriber data into the new VLR or SGSN via INSERT_SUBSCRIBER_DATA and may trigger a CANCEL_LOCATION to the previous VLR or SGSN to remove outdated records, ensuring data consistency across the network. Similarly, CANCEL_LOCATION explicitly removes subscriber data from a VLR or SGSN upon detachment, subscription withdrawal, or mobility events, with parameters indicating the cancellation type (e.g., for IMSI detach) to set flags like Mobile Not Reachable (MNRF). These procedures support initial attachment and periodic location updates, governed by timers such as the Subscribed Periodic Location Area Update (LAU) Timer, which prompt the MS to report its position at intervals to refresh HLR records and detect network faults. Roaming support in MAP relies on authentication and location procedures to verify and authorize subscribers in visited networks. The SEND_AUTHENTICATION_INFO operation allows a VLR or SGSN to request authentication vectors (e.g., RAND, SRES, Kc for GSM; or extended sets for UMTS/EPS) from the HLR or AuC using the IMSI, enabling secure access during roaming without exposing permanent keys. Up to five vectors can be requested in a single invocation to support multiple challenges, facilitating international roaming across Public Land Mobile Networks (PLMNs) by coordinating global titles (e.g., E.164 or E.212 formats) for inter-network signaling. For international roaming number portability, MAP procedures like PROVIDE_ROAMING_NUMBER allocate a temporary Mobile Subscriber Roaming Number (MSRN) tied to the subscriber's IMSI, allowing calls to be routed to the visited MSC while preserving the original directory number across borders and operators. This ensures seamless connectivity, with roaming restrictions enforced via HLR parameters to control access in foreign PLMNs. Fault recovery procedures in MAP restore subscriber data after network disruptions, such as VLR restarts or unconfirmed detachments. The RESTORE_DATA operation is invoked by a VLR or SGSN toward the HLR, providing the IMSI or MSRN to retrieve and reinsert essential data (e.g., subscription profiles and location information), often in conjunction with INSERT_SUBSCRIBER_DATA to reinstate without requiring a full re-registration. This mechanism supports recovery from system failures, updating the Local Mobile Station Identity (LMSI) if provided and ensuring minimal service interruption. Key concepts in MAP mobility management include IMSI-based attachment and detachment, where attachment via UPDATE_LOCATION registers the as reachable, and detachment sets IMSI-detached flags in the HLR to block incoming services until reattachment. Periodic location updates, triggered by mobility events or timers, prevent stale data and enable proactive fault detection, while international integrates number portability through MSRN assignments that abstract the subscriber's location for global call routing. An example of MAP's role in mobility is during inter-MSC handovers, where an UPDATE_LOCATION from the target MSC to the HLR updates the serving entity, allowing the HLR to redirect subsequent paging or data to the new MSC for uninterrupted mobility.

Call Handling and Supplementary Services

The Mobile Application Part (MAP) facilitates call handling by enabling the routing of mobile-terminated calls through interactions between the Gateway Mobile Switching Center (GMSC), Home Location Register (HLR), and Visitor Location Register (VLR). For incoming calls, the GMSC queries the HLR using the SEND_ROUTING_INFO operation, which retrieves the subscriber's current location and returns routing details such as the serving or VLR address, along with parameters like the (IMSI), (MSISDN), and roaming number if applicable. This operation ensures the call is directed to the appropriate serving node, supporting features like (CUG) checks and forwarding counters to manage call diversion scenarios. Once the routing information is obtained, the VLR assigns a temporary Mobile Station Roaming Number (MSRN) via the PROVIDE_ROAMING_NUMBER operation, which the HLR forwards back to the GMSC for actual call setup. This process is critical for scenarios, where the MSRN masks the subscriber's true location, and it includes parameters such as the target cell ID for support. MAP supports supplementary services by allowing network entities to manage and invoke user-configured features during active sessions. The InterrogateSS operation enables the VLR or to query the HLR for profiles, retrieving details like the forwarded-to number, service codes, and forwarding options (e.g., unconditional, busy, or no reply) to apply diversions without disrupting the call flow. For dynamic updates, supplementary service operations such as ActivateSS, DeactivateSS, and RegisterSS permit the VLR or to register, activate, or deactivate services such as , call barring, or multi-party calls by modifying the subscriber's service status and options in the HLR, with parameters including the supplementary service code (SS-Code) and subscription options. These operations ensure seamless integration of services like call hold or transfer, maintaining service continuity across network boundaries. Short Message Service (SMS) handling in MAP involves dedicated operations for both mobile-terminated and mobile-originated messages, integrating with the core network's signaling. The MT-ForwardSM operation allows the SMS Center (SMSC) to deliver incoming SMS via the GMSC to the serving MSC or SGSN, passing parameters such as the SMS user data, originating and destination addresses, and delivery status indicators to ensure reliable transport to the (MS). Conversely, the MO-ForwardSM operation routes outgoing SMS from the MS through the MSC or SGSN to the SMSC, including the message payload and routing addresses to facilitate store-and-forward delivery. These procedures handle errors like delivery failures or absent subscribers, supporting for longer messages. For packet data services, extends call handling to GPRS and contexts through operations that coordinate with location management. The READY_FOR_SM operation notifies the HLR from the SGSN when the subscriber becomes available for short over packet domains, providing the IMSI, SGSN , and reasons to update routing preferences. Similarly, SEND_ROUTING_INFO_FOR_GPRS enables the GGSN or SMS-GMSC to query the HLR for the serving SGSN's during context activation, using parameters like the IMSI and GPRS node indicators to route data sessions or SMS efficiently. These ensure that supplementary services and SMS remain accessible in GPRS environments without interrupting voice calls. Operation and maintenance (O&M) functions in provide access to subscriber data for diagnostics and enhancement. The AnyTimeSubscriptionInformation operation allows authorized entities like the Service Control Function (gsmSCF) or Operations and Maintenance Center (OMC) to retrieve comprehensive profile details from the HLR, including location, subscribed services, and identity information via specified request types. This supports proactive call handling by enabling dynamic provisioning of supplementary services and monitoring of routing behaviors.
OperationPurposeKey ParametersNetwork Role
PROVIDE_ROAMING_NUMBERAssigns temporary number for call IMSI, , number, target cell IDVLR to HLR; enables GMSC call setup in
SEND_ROUTING_INFORetrieves location and for mobile-terminated calls, IMSI, GMSC address, forwarding countHLR to GMSC; locates serving /VLR
InterrogateSSQueries status of supplementary services including SS-Code, basic service code, forwarding optionsHLR to VLR/; retrieves forwarding profiles
ActivateSS/DeactivateSSActivates or deactivates supplementary servicesSS-Code, SS-Status, subscription optionsVLR/ to HLR; updates service profiles
MT-ForwardSMDelivers incoming to MSSM-RP-DA/OA/UI, data, more-to-send flagSMSC via GMSC to /SGSN
MO-ForwardSMForwards outgoing to SMSCSM-RP-OA/DA/UI, data/SGSN to SMSC
READY_FOR_SMNotifies readiness for in packet domainIMSI, SGSN number, alert reasonSGSN to HLR; triggers
SEND_ROUTING_INFO_FOR_GPRSGets for GPRS services/PDP contextsIMSI, SGSN/GGSN addressHLR to GGSN/SMS-GMSC
AnyTimeSubscriptionInformationRetrieves subscriber data for O&MIMSI, requested info types, subscriber identityHLR to gsmSCF/OMC; supports diagnostics
All operations utilize TCAP-based dialogues and handle errors such as unknown subscriber or system failures to maintain robustness.

Implementation and Signaling

Network Implementation

The Mobile Application Part (MAP) is integrated into key core network elements to facilitate database operations and local processing in GSM and UMTS networks. In the Home Location Register (HLR) and Authentication Center (AuC), MAP handles subscriber data management, authentication vectors generation, and location updates by exchanging messages such as Update Location and Authentication Information requests over the SS7 stack. The Visitor Location Register (VLR) and Mobile Switching Center (MSC) utilize MAP for local subscriber processing, including registration and call routing, via interfaces like the D-interface for HLR-VLR communication. For the packet-switched domain, the Serving GPRS Support Node (SGSN) employs MAP over the Gr-interface to interact with the HLR for mobility management and PDP context activation, ensuring seamless integration between circuit- and packet-switched services. MAP signaling is transported over traditional SS7 networks using Time Division Multiplexing (TDM) links, such as E1 (2.048 Mbps) or T1 (1.544 Mbps) lines, which carry SS7 messages at 56 or 64 kbps per channel. In modern deployments, Signaling Transport (SIGTRAN) enables MAP over IP networks, adapting SS7 protocols like MTP3 to IP via Stream Control Transmission Protocol (SCTP) for improved scalability and cost efficiency in hybrid TDM-IP cores. This dual transport approach allows operators to migrate gradually while maintaining compatibility with legacy infrastructure. Open-source implementations of include the OpenSS7 project, which provides a full SS7 stack with support for HLR and VLR emulation in research and testing environments. Similarly, Mobius SS7 offers a Java-based open-source SS7 protocol stack including for mobile services integration. Commercial stacks are embedded in vendor core network products; for instance, Ericsson's HLR and solutions incorporate for SS7-based signaling in / cores, supporting high-availability deployments. Nokia's core network elements, such as the HLR/, similarly implement protocols for subscriber management and support. Interoperability challenges arise when bridging and MAP variants, where differences in message formats and optional parameters require protocol to ensure consistent location updates and authentication across generations. For global , mappings between MAP and ANSI-41 (used in CDMA networks) address discrepancies in operations like intersystem page and handoff, as standardized for subscriber mobility between and TIA networks. Performance in MAP deployments is constrained by SS7 capacities, with a typical 64 kbps TDM supporting 10-50 () depending on average message sizes of 100-500 bytes. is achieved through mated pairs of Signal Transfer Points (STPs) or core elements like HLRs, where dual configurations route traffic equivalently to prevent single points of failure and maintain uptime during or node outages.

MAP Signaling Procedures

The Mobile Application Part () signaling procedures operate over the Signaling System No. 7 (SS7) network to facilitate communication between core network elements in GSM and UMTS systems, enabling , call handling, and supplementary services through structured dialogues and operations. These procedures define the sequence of messages exchanged between nodes such as the Mobile Switching Center (MSC), Visitor Location Register (VLR), Home Location Register (HLR), and Serving GPRS Support Node (SGSN), ensuring subscriber data consistency and service continuity across networks. Key SS7 interfaces underpin these procedures, each serving specific interactions between network elements. The B interface connects the MSC and VLR for local queries, such as handovers via MAP_PREPARE_HANDOVER, and internal authentication procedures using vectors obtained from the HLR. The C interface links the MSC to the HLR for call routing and subscriber , including operations like MAP_SEND_ROUTING_INFO and MAP_PROVIDE_ROAMING_NUMBER. The D interface facilitates HLR-VLR or HLR-SGSN exchanges for subscriber data insertion via MAP_INSERT_SUBSCRIBER_DATA and purging with MAP_PURGE_MS, particularly after GPRS location updates using the SGSN number; location management uses MAP_UPDATE_LOCATION on this interface. Additionally, EIR-related interfaces enable equipment identity checks, where the VLR, MSC, or SGSN queries the Equipment Identity Register () using MAP_CHECK_IMEI to verify the IMEI or IMEISV, with the EIR address derived from the equipment itself.
InterfacePrimary NodesKey MAP OperationsPurpose
BMSC-VLRMAP_PREPARE_HANDOVER, MAP_PROVIDE_ROAMING_NUMBER, MAP_SEND_IDENTIFICATIONLocal and call handling queries
CMSC-HLRMAP_SEND_ROUTING_INFO, MAP_PROVIDE_ROAMING_NUMBERCall and subscriber
DHLR-VLR/SGSNMAP_INSERT_SUBSCRIBER_DATA, MAP_PURGE_MS, MAP_UPDATE_LOCATIONData updates, cleanup, and location management post-location changes
EIR-relatedVLR/MSC/SGSN-EIRMAP_CHECK_IMEIEquipment identity verification
Procedural flows illustrate these interfaces in action. In a location update, the VLR initiates a MAP_UPDATE_LOCATION dialogue with the HLR, sending the IMSI and VLR number; the HLR responds by inserting subscriber profile data via MAP_INSERT_SUBSCRIBER_DATA or confirming the update with UpdateLocationRes, ensuring the subscriber's location is registered for incoming services. Similarly, involves the VLR requesting (RAND, , ) or from the HLR using MAP_SEND_AUTHENTICATION_INFO, which the VLR compares against values generated by the to validate the subscriber during registration or location updates. These flows maintain service availability while updating network records dynamically. Error handling in MAP procedures uses standardized rejection codes to manage failures gracefully, often triggering abort mechanisms to terminate dialogues. For instance, code 1 (unknown subscriber) is returned by the HLR if the IMSI is unrecognized or data is unavailable, preventing further processing. Code 6 (illegal equipment) is issued by the EIR for prohibited or invalid IMEI/IMEISV, halting equipment-related operations. Other causes, such as absent subscriber (code 3) or busy subscriber (code 4), indicate temporary unavailability and may lead to dialogue abortion via TCAP mechanisms, ensuring resources are not wasted on invalid requests.
Error CodeDescriptionTypical TriggerConsequence
1Unknown subscriberUnrecognized IMSI in HLRDialogue rejection and abort
6Illegal equipmentInvalid IMEI in Equipment check failure and abort
3Absent subscriberSubscriber temporarily unavailableTemporary denial with retry option
4Busy subscriberSubscriber engaged in another sessionCall or service deferral
Differences between circuit-switched () and packet-switched () domains affect procedural interactions with the HLR. In the CS domain, VLR-HLR signaling handles voice and mobility via operations like MAP_UPDATE_LOCATION and MAP_RESTORE_DATA, focusing on MSC-VLR-HLR paths for traditional . In contrast, the PS domain uses SGSN-HLR exchanges for data services, such as MAP_UPDATE_GPRS_LOCATION for GPRS attachment and MAP_PURGE_MS to clean up data when reported by the SGSN, accommodating packet without circuit establishment. The PURGE_MS operation, applicable in both domains, allows the VLR or SGSN to request HLR removal of outdated location or information, preventing stale data accumulation. MAP employs two primary transaction models to structure these procedures: single-dialogue and linked transactions. Single-dialogue models use a standalone TCAP sequence (TC-BEGIN to TC-END) for simple operations, such as updates or information requests, completing in one exchange without interdependencies. Linked transactions, however, chain multiple operations using dialogue IDs for complex scenarios like handovers, where MAP_PREPARE_HANDOVER initiates a sequence across MSCs, followed by MAP_PREPARE_SUBSEQUENT_HANDOVER or MAP_ALLOCATE_HANDOVER_NUMBER to maintain call continuity, ensuring seamless without service interruption. Procedures for facilities like roaming numbers, such as MAP_SEND_ROUTING_INFO_FOR_SM, often follow single-dialogue models but integrate with call handling services.

Evolution and Modern Usage

Adaptations in Later Networks

In the , specified in Release 99, the was retained within the circuit-switched core network to provide with networks, enabling seamless mobility management and call handling across and environments. This integration allowed UMTS nodes, such as the and Visitor Location Register (VLR), to interface with GSM Home Location Registers (HLRs) using existing MAP procedures without requiring immediate protocol overhauls. As networks evolved to in Release 8 and beyond, MAP usage became limited, primarily through emulation over interfaces for interworking scenarios. Specifically, the S6a and S6d interfaces between the Mobility Management Entity (MME) or Serving GPRS Support Node (SGSN) and the Home Subscriber Server (HSS) employ Diameter as the primary protocol, but support MAP emulation via an Interworking Function (IWF) to handle legacy / subscribers, as detailed in 3GPP TS 29.272. This emulation facilitates non-IMS voice fallback, such as Circuit Switched Fallback (CSFB), where devices redirect to / for voice services, ensuring service continuity without full protocol replacement. In systems under Release 15, plays a minimal role, as the 5G Core (5GC) largely replaces legacy signaling with Service-Based Architecture (SBA) using , though persists for EPC interworking. is retained solely for legacy Circuit Switched () fallback and interworking with / networks, such as in Evolved Packet System-International Mobile Subscriber Identity (EPS-IMSI) procedures, where 5G nodes query legacy HLRs via to retrieve subscriber identities during fallback scenarios. This limited retention supports gradual network sunsetting while prioritizing new 5G-native protocols. As of Release 18 (2024), continues to be maintained primarily for such legacy interworking in 5G environments, with no plans for immediate sunsetting. Key adaptations to include extensions for Phase 4, introduced in Release 5, which enhance services by integrating MAP with (IMS) capabilities for advanced call control and service triggering across and beyond. Additionally, from Release 8 onward, MAP mandates support for IP transport via protocols like M3UA, allowing SS7-based MAP to operate over IP networks for improved efficiency and scalability in hybrid environments. Deprecation trends in 3GPP Release 15 and later emphasize full migration to Diameter and SBA, confining MAP to 2G/3G interworking only, with Interworking Functions handling translations to minimize legacy dependencies and enhance security in modern all-IP architectures. This shift aligns with the phasing out of circuit-switched elements, promoting unified packet-switched signaling across 4G and 5G ecosystems.

Security Considerations

The Mobile Application Part (MAP) protocol, operating within the SS7 signaling framework, inherits significant security vulnerabilities due to the absence of built-in encryption and authentication mechanisms in its foundational design. SS7 was developed in an era assuming a closed, trusted network environment among operators, leaving MAP messages transmitted in plaintext, which exposes sensitive operations such as location updates and subscriber data queries to interception. This lack of encryption enables attacks like unauthorized location tracking via Send Routing Information (SRI) messages or SMS interception through Update Location procedures, as demonstrated in real-world exploits targeting global telecom interconnects. Authentication in basic MAP relies on a triplet-based system derived from , consisting of a random (RAND), signed response (SRES), and ciphering key (Kc), which provides only one-way of the subscriber to the without verifying the network's legitimacy. This asymmetry makes MAP susceptible to false base station attacks, where an adversary impersonates a legitimate to compel a device to authenticate and reveal its identity or keys, potentially leading to or denial of service. The absence of in core MAP procedures further exacerbates risks during , allowing rogue entities to inject malicious signaling traffic. To address these flaws, later 3GPP releases introduced mitigations such as Network Domain Security for MAP (NDS/MAP), specified in TS 33.200, which provides application-layer security through MAPsec protocols for integrity protection, confidentiality, and optional replay protection via security associations negotiated between key agreement centers. For networks using SIGTRAN to transport MAP over IP, IPsec is mandated in TS 33.210 to secure the transport layer against eavesdropping and tampering, ensuring end-to-end protection for signaling links. Additionally, SS7 firewalls emerged as a practical defense, filtering anomalous MAP traffic based on global titles, point codes, and message types to block unauthorized access attempts. Notable incidents underscore MAP's role in broader SS7 vulnerabilities, including exploits revealed at the 31st in , where researchers mapped global SS7 interconnects to demonstrate large-scale capabilities via MAP queries for and call interception, affecting millions without detection. These revelations prompted international scrutiny and informed 3GPP TS 33.203 guidelines, which outline security for interworking between MAP and protocols, emphasizing TLS-based protection and during transitions in IMS environments to prevent downgrade attacks. Best practices for securing include network isolation through strict controls and global title translations to limit exposure, as recommended by FS.07, alongside continuous monitoring for anomalous traffic patterns such as excessive SRI requests indicative of tracking attempts. Operators are advised to deploy signaling firewalls at interconnect borders and integrate threat intelligence sharing via platforms like T-ISAC to dynamically block malicious origins. Long-term, migration to in / networks, coupled with service-based architectures secured by mutual TLS and 2.0, reduces reliance on legacy MAP while maintaining backward compatibility through secure gateways. As of 2025, continues to emphasize information sharing and monitoring to mitigate persistent SS7/MAP threats in hybrid networks.

References

  1. [1]
    Specification # 29.002 - 3GPP
    Mobile Application Part (MAP) specification. Status: Under change control ... Diameter based interface between SGSN and SMS central functions (Stage 2/3).
  2. [2]
    [PDF] ETSI TS 129 002 V14.3.0 (2017-05)
    ... Mobile Application Part (MAP) specification. (3GPP TS 29.002 version 14.3.0 Release 14). TECHNICAL SPECIFICATION. GLOBAL SYSTEM FOR. MOBILE COMMUNICATIONS. R ...
  3. [3]
    [DOC] IR.61-v14.0.docx - GSMA
    Mobile Application Part. Mobile related SS7 application protocol that is used in the GSM Core Network to talk to the AuC/HLR. MNO. Mobile Network Operator.
  4. [4]
    [PDF] ETSI TS 129 002 V18.0.0 (2024-05)
    3GPP TS 29.002 version 18.0.0 Release 18​​ IPRs essential or potentially essential to normative deliverables may have been declared to ETSI.
  5. [5]
    Our history - About Us - GSMA
    The GSMA started out as the GSM MoU (Memorandum of Understanding) Association. Its objectives were to: • ease cooperation between countries deploying GSM ( ...
  6. [6]
    Our history - ETSI
    ETSI was set up in 1988 by the European Conference of Postal and Telecommunications Administrations (CEPT) in response to proposals from the European Commission ...
  7. [7]
    [PDF] GSM 09.02 - Version 3.11.0 - ETSI
    This data type is defined to allow the Mobile Application Part protocol to carry information elements defined in other Recommendations without any direct ...
  8. [8]
    [EPUB] The Creation of Standards for Global Mobile Communication - ETSI
    The standardization work was done in CEPT GSM from 1982 to 1989, then in ETSI TC GSM and SMG until 1998/2000 and since then in 3GPP. Initially in CEPT only ...
  9. [9]
    [PDF] The development of GSM standards and features - NET
    Phase 2 was frozen in October 1995, and subse- quent improvements and additions will automatically make their way into Phase 2+. The history of GSM's phases is ...
  10. [10]
    SMS Introduction - SmsSolutions.net
    SMS was created as part of the GSM Phase 1 standard. The first short message is believed to have been sent in December 1992 from a PC to a mobile phone on ...
  11. [11]
    Thirty years on from the call that transformed how we communicate
    Jul 1, 2021 · The first official GSM call between former Finnish Prime Minister Harri Holkeri and Deputy Mayor of Tampere Kaarina Suonio, on July 1, 1991, lasted just over ...
  12. [12]
    The Road to ANSI-41 | McGraw-Hill Education - Access Engineering
    In 1984, the development of the first version of a cellular internetworking standard had begun. IS-41-0 was eventually published in February 1988 and addressed ...
  13. [13]
    [PDF] ETSI TS 129 002 V3.8.0 (2001-03)
    ... Mobile Application Part (MAP) specification. (3GPP TS 29.002 version 3.8.0 Release 1999). GLOBAL SYSTEM FOR. MOBILE COMMUNICATIONS. R. Page 2. 1. ETSI. ETSI TS ...
  14. [14]
    The 3GPP's System of Parallel Releases
    3GPP uses a system of parallel "Releases" which provide developers with a stable platform for the implementation of features at a given point.Release 20 · Release 19 · Release 18 · Release 16Missing: 1998 | Show results with:1998
  15. [15]
    09.02 : Mobile Application Part (MAP) Specification - 3GPP
    Technical specification (TS). Initial planned Release: Phase 1. Internal ... Version, Upload date, Comment. CN#23 · 7.15.0. 2004-03-23. 22813, CN#23, 26235. CN#21.
  16. [16]
    [PDF] GSM 09.02 - ETSI
    ... Mobile Application Part (MAP) specification. (GSM 09.02). ETSI. European Telecommunications Standards Institute. ETSI Secretariat. Postal address: F-06921 ...
  17. [17]
    [PDF] Overview of 3GPP Release 5
    ... Release 4 Location Services. The main ... supports the handover functionality for maintaining the service while the terminal changes the location.
  18. [18]
  19. [19]
    [PDF] Overview of 3GPP Release 4 Summary of all Release 4 Features v ...
    29.998-05-4 Part 5: User Interaction Service Mapping; Subpart 4: API to SMS Mapping. 29.998-06. Part 6: User Location and User Status Service Mapping to MAP.
  20. [20]
    3GPP Work Item IMS mapping to Specs
    3GPP Work Item mapping to Change Requests. 3GPP Work Item = 1273 (IMS). This page lists the approved Change Requests to 3GPP Technical Specifications and ...Missing: integration later
  21. [21]
  22. [22]
    ETSI TS 129 002 V17.1.0 (2022-05)
    This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical ...
  23. [23]
    [PDF] ETSI TS 129 002 V16.3.0 (2021-08)
    This technical specification covers digital cellular systems including GSM, UMTS, LTE, 5G, and Mobile Application Part (MAP) specification.
  24. [24]
    [PDF] TSGS#6(99)545 - 3GPP
    The AuC transmits the data needed for authentication and ciphering via the HLR to the VLR, MSC and SGSN which need to authenticate a mobile station. Page 4 ...
  25. [25]
    Design: Applications: GSM/MAP HLR GPRS - OpenSS7
    This protocol supports signalling exchange with the HLR as defined in 3GPP TS 29.002, with the enhancements for GPRS as described in 3GPP TS 23.060. TCAP and ...
  26. [26]
    SGSN Administration Guide, StarOS Release 21.25 - Cisco - Cisco
    Sep 30, 2021 · Lg: This is a Mobile Application Part (MAP) interface, between the ... The SGSN sends a IMSI Detach Indication message to the MSC/VLR.
  27. [27]
    [PDF] SS7-over-IP using SIGTRAN - Oracle Help Center
    At the Signaling Gateway, M3UA indicates to remote MTP3 users at IP end points when an SS7 signaling point is reachable or unreachable, or when SS7 network ...<|control11|><|separator|>
  28. [28]
    MAPS™ SIGTRAN (SS7 over IP) Protocol Emulator
    GL's MAPS™ SIGTRAN is an advanced protocol simulator/tester for SS7 simulation over IP Networks. It can simulate a Signaling Gateway and Softswitch ISUP ...
  29. [29]
    [PDF] Mobile Application Part Interface (MAPI) Specification - OpenSS7
    This document is a Specification containing technical details concerning the imple- mentation of the Mobile Application Part Interface (MAPI) for OpenSS7.
  30. [30]
    About Mobius SS7
    Mobius SS7 is for mobile services, enabling apps to communicate with legacy SS7 equipment. It is an open-source Java implementation of the SS7 protocol stack.
  31. [31]
    Achieving 5G network security with new strategies - Ericsson
    Signaling protocols that are used in those networks like the international Signaling System 7 (SS7) standard, including Mobile Application Part (MAP) and IP- ...
  32. [32]
    [PDF] Cloud-native packet core network functions - Nokia
    This section discusses the key architectural pillars of cloud-native applications and the applicability of these pillars to packet core network functions.
  33. [33]
    [PDF] Network Interworking Between GSM MAP and ANSI-41 ... - 3GPP2
    This standard addresses interworking between ANSI-41 MAP and GSM 4 MAP networks for subscriber roaming, specifying services, information flows, and message ...Missing: development | Show results with:development
  34. [34]
    5 Dimensioning - Oracle Help Center
    Average MSU size is 100 bytes/MSU over M3UA; Less than 5 connections per IP E5-ENET-B card; No monitoring is required. Calculation: During normal operation, ...
  35. [35]
    [PDF] Signaling Delivery Controller - SS7 Diameter Interworking Function
    May 1, 2015 · Processing messages with an average size of 0.5KB, each SS7 link can hold approximately. 10 SS7 TPS per link. The basic SS7 license is for the ...Missing: throughput | Show results with:throughput
  36. [36]
    [PDF] Common Channel Signalling System No. 7 (SS7)
    A transaction is a one-to-one mapping of a dialogue onto the services of the transaction sublayer when the users are the component sublayer. The mapping is ...Missing: TPS | Show results with:TPS
  37. [37]
    [PDF] ETSI TS 129 002 V3.7.1 (2000-12)
    The cross reference between GSM, UMTS, 3GPP and ETSI identities can be found under www.etsi.org/key . Page 4. ETSI. 3GPP TS 29.002 version 3.7.1 Release 1999.
  38. [38]
    [PDF] ETSI TS 129 272 V17.3.0 (2022-07)
    This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical ...
  39. [39]
    [PDF] ETSI TS 129 501 V15.9.0 (2025-01)
    4th Field: - Before the OpenAPI freeze of a 3GPP Release, the 4th field (DRAFT) shall be supplied as follows: Page 15. ETSI. ETSI TS 129 501 V15.9.0 (2025-01).Missing: Diameter | Show results with:Diameter
  40. [40]
    [PDF] ETSI TS 123 078 V14.0.0 (2017-04)
    This Technical Specification (TS) has been produced by the ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical ...Missing: extensions | Show results with:extensions
  41. [41]
    [PDF] ETSI TS 129 002 V8.8.1 (2009-02)
    This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical ...
  42. [42]
    IR.82 SS7 Security Network Implementation Guidelines - GSMA
    Oct 10, 2019 · This document outlines general SS7 security measures (MAP and CAP signalling), including measures specific to SMS security, and the possible enforcement point ...Missing: best | Show results with:best
  43. [43]
    FS.11 SS7 Interconnect Security Monitoring and Firewall Guidelines
    Oct 10, 2019 · This document describes how to monitor SS7 traffic, including prevention and detection techniques against suspected attacks.Missing: practices | Show results with:practices
  44. [44]
    31C3 2014 eng SS7map mapping vulnerability of the ... - YouTube
    Feb 18, 2022 · Chaos Computer Club - Congress - 2014 Hacking conference #hacking, #hackers, #infosec, #opsec, #IT, #security #ChaosComputerClub The Chaos ...<|separator|>
  45. [45]
    [PDF] ETSI TS 133 203 V17.1.0 (2022-05)
    This Technical Specification (TS) has been produced by ETSI 3rd Generation Partnership Project (3GPP). The present document may refer to technical ...Missing: Diameter | Show results with:Diameter
  46. [46]
    FS.07 SS7 and SIGTRAN Network Security - GSMA
    Oct 10, 2019 · This document provides an overview of SS7 and SIGTRAN and how to handle SS7 messages on the edge of the network.
  47. [47]
    SS7: Securing a Legacy Protocol in a Modern Threat Landscape ...
    Sep 18, 2025 · The SS7 signalling protocol, has critical vulnerabilities due to its outdated design: it lacks authentication and encryption, making it easier ...
  48. [48]
    [PDF] Security Considerations for the 5G Era 1
    Jul 22, 2020 · of SS7 and Diameter vulnerabilities. Central to this remediation are the GSMA recommendations to implement an SS7 or Diameter firewall at the ...<|control11|><|separator|>