Hey everyone! 👋

Telecom networks are much more complex than what we see when making a phone call or using mobile internet.

Behind every call, message, and network connection, multiple systems communicate with each other. They exchange information, authenticate subscribers, manage connections, and make routing decisions.

To understand telecom security, we first need to understand how these networks work.

In this series, we'll explore telecom infrastructure from the fundamentals to the engineering concepts behind building a telecom security platform.

We'll focus on why each component exists, what it does, how it communicates with other components, and how everything works together.

Our goal is to develop a practical understanding of telecom networks and the technologies used to protect them.

Lesson 1: How Does a Mobile Network Actually Work?

Let's start with a simple question.

You have a smartphone. You want to make a call to someone.

How does that call travel from your phone to the other person's phone?

Your phone doesn't communicate directly with the other person's phone. A large telecom infrastructure works between the two devices.

A simplified call flow looks like this:

1. You initiate a call from your phone.
2. Your phone communicates with a nearby mobile tower.
3. The request travels through the operator's network.
4. The core network processes the request and determines where the call should go.
5. The call is routed toward the destination network.
6. The other person's phone starts ringing.

This entire infrastructure is part of a mobile network.

A company that operates a mobile network and provides mobile services is called an MNO (Mobile Network Operator).

Examples include:

• Grameenphone
• Robi
• Banglalink
• Airtel

An MNO manages different network components and systems to provide connectivity and communication services to subscribers.

Lesson 2: The Main Components of a Mobile Network

A mobile network contains many components. Each component has a specific responsibility.

Let's understand some important ones.

1. BTS - Base Transceiver Station

A BTS contains the radio equipment that provides wireless communication between mobile devices and the network.

Its main responsibility is to transmit and receive radio signals.

In simple terms, when your phone communicates with a nearby mobile tower, the radio equipment at that site handles the wireless connection.

2. BSC - Base Station Controller

A BSC controls and coordinates multiple BTSs in traditional GSM networks.

Its responsibilities include:

• Radio resource management
• BTS coordination
• Managing radio-related operations
• Supporting mobility between cells

Think of the BSC as a controller responsible for managing a group of base stations.

3. MSC - Mobile Switching Centre

The MSC is an important component of traditional 2G/3G circuit-switched core networks.

Its responsibilities include:

• Call routing
• Call setup
• Mobility management
• Communication with other networks
• Managing circuit-switched voice services

When you make a traditional mobile call, the MSC plays an important role in establishing and routing that call.

4. HLR - Home Location Register

The HLR is a central subscriber database used in traditional mobile networks.

It stores subscriber identity and service-related information.

Examples include:

• Subscriber identity
• Service subscriptions
• Subscriber-related network information
• Location information associated with the serving network

The network uses this information to identify subscribers and determine which services they are allowed to use.

5. HSS - Home Subscriber Server

The HSS is an important subscriber database and authentication component in 4G LTE networks.

It supports:

• Subscriber authentication
• Subscription management
• Subscriber-related information
• Network access control functions

The HSS plays an important role when a subscriber connects to an LTE network.

HLR vs HSS

Although both systems manage subscriber information, they are associated with different generations of mobile network architecture.

These are simplified differences. Real operator networks may support multiple generations of technology and interworking between different systems.

Lesson 3: What Is Signaling?

Now let's move to one of the most important concepts in telecom networks.

Imagine that you are making a phone call.

Your phone effectively sends a request to the network:

"I want to make a call."

The network needs to perform several operations before connecting the call.

It may need to:

• Identify the subscriber.
• Check whether the subscriber is authorized.
• Find the destination.
• Determine how to route the call.
• Coordinate with other network components.

Different network components exchange requests and responses to complete these operations.

This communication is called signaling.

In simple terms:

Signaling is the control communication that allows telecom network components to coordinate their operations.

Control Plane vs User Plane

To understand signaling properly, we need to understand two important concepts.

Control Plane - Signaling Traffic

The control plane handles the instructions and decisions required to operate the network.

Examples:

• Call setup
• Subscriber authentication
• Location updates
• Routing information queries
• Session management

User Plane - User Traffic

The user plane carries the actual communication between users.

Examples:

• Voice
• Video
• Internet data

Let's consider a simple example.

You make a phone call:

• Signaling: Network components exchange control messages to establish and manage the call.
• User traffic: Once the call is connected, voice data travels between the users.

These two types of traffic serve different purposes, even though they work together to provide communication services.

For our ExpSMS Telecom Security Gateway (TSG) MVP, the initial focus is on monitoring SS7 and Diameter signaling traffic. Monitoring voice or general internet data is outside the initial scope.

Lesson 4: What Is SS7?

SS7 stands for Signaling System No. 7.

It is a traditional telecom signaling protocol suite used by mobile and fixed-line networks.

SS7 plays an important role in traditional 2G/3G network operations and in communication between legacy telecom systems.

Imagine a mobile network containing:

• MSC
• HLR
• STP

These network elements may communicate with each other using SS7 signaling.

Important SS7 Network Elements

One important thing to understand:

SS7 is a protocol suite, not a single software application or network device.

It contains different protocols and layers that perform different communication tasks.

Some important SS7 protocols include:

• MTP: Message Transfer Part
• SCCP: Signaling Connection Control Part
• TCAP: Transaction Capabilities Application Part
• MAP: Mobile Application Part
• ISUP: ISDN User Part

Each protocol has a specific responsibility within the signaling architecture.

For ExpSMS TSG, understanding MAP, TCAP, SCCP, and SS7 traffic transported through SIGTRAN is particularly important.

Lesson 5: What Is Diameter?

Diameter is an IP-based protocol framework used for Authentication, Authorization, and Accounting (AAA), along with other telecom signaling functions.

It plays an important role in 4G LTE networks.

Consider a simplified LTE network containing:

• MME
• HSS

When a subscriber connects to the network, the MME may need to communicate with the HSS to verify subscriber information.

The MME effectively asks:

"I need to verify this subscriber's authentication and subscription information."

The HSS processes the request and returns the appropriate response.

This communication can take place using the Diameter protocol.

Important Diameter Concepts

To understand Diameter architecture, we need to become familiar with several concepts:

• Peer: Another Diameter node participating in communication.
• Origin-Host: Identifies the host sending a Diameter message.
• Origin-Realm: Identifies the sender's administrative domain.
• Destination-Host: Identifies the intended destination host.
• Command Code: Identifies the type of Diameter request or answer.
• Application ID: Identifies the Diameter application associated with a message.
• AVP: Attribute-Value Pair, used to carry structured information inside Diameter messages.

These concepts help network components identify each other, exchange information, and perform signaling operations.

Lesson 6: SS7 vs Diameter

Now that we understand the basics of both technologies, let's compare them.

The important thing to remember is that modern telecom networks may use both technologies.

Even as operators move toward newer network generations, legacy systems and interworking requirements mean that SS7 can remain relevant.

Understanding both protocols is therefore important when designing a telecom security platform.

Bringing Everything Together

Let's connect all the concepts we have discussed.

A mobile network contains different network elements.

Each element has a specific responsibility.

These elements communicate with each other through signaling messages to coordinate network operations.

Depending on the network generation and function, this communication may use SS7 or Diameter.

However, signaling traffic also introduces security challenges.

If malicious or unexpected signaling messages enter a telecom network, they may create risks for subscriber privacy, network availability, and service reliability.

This is where telecom signaling security becomes important.

The goal of ExpSMS TSG is to monitor signaling traffic, understand its structure and behavior, and identify potential security threats.

At a high level, its processing flow is:

Observe → Decode → Understand → Analyze → Detect → Alert

Each stage has a specific responsibility:

• Observe: Receive or access signaling traffic.
• Decode: Understand the protocol structure and message contents.
• Understand: Identify the meaning and context of each message.
• Analyze: Evaluate message patterns and network behavior.
• Detect: Identify suspicious activities or potential threats.
• Alert: Notify the relevant operations or security teams.

For the initial MVP, this process operates in passive monitoring mode. It observes and analyzes traffic without actively blocking or modifying network signaling.

Quick Knowledge Check

Before considering the fundamentals complete, let's check your understanding.

Final Thoughts

Understanding telecom security requires more than knowing how a firewall works.

We need to understand the network itself, the responsibilities of its components, how those components communicate, and what information flows between them.

For software engineers and system designers, this is also an interesting engineering challenge. Telecom security brings together networking, protocol engineering, distributed systems, performance optimization, and security analysis.

The first step is understanding the infrastructure before designing the solution.

If you want to strengthen your general networking knowledge alongside this series, you can explore my Networking article series.

About the Author

Anik Sikder is a Software Engineer and Assistant System Engineer at ExpSMS, working across software engineering, system architecture, and business technology solutions.

His areas of focus include SaaS and ERP architecture, Python, Django, FastAPI, multi-tenant systems, business automation, and system design.