IMS Roaming & Signalling Security

Aims — what you can do after

• Draw the roaming architecture — home/visited networks, the IPX, the DEA and the SEPP — and say what each node does.
• Read SS7/MAP and CAMEL roaming flows as call-flow ladders.
• Read Diameter roaming flows (S6a) and explain Diameter routing, realms and the border gateway.
• Explain VoLTE & VoNR roaming — home-routed (S8HR) vs local breakout (LBO), and where the media goes.
• Explain 5G roaming security — the SEPP, N32, PRINS vs TLS, and roaming over the service-based interface.
• Operate a signalling firewall — classify inbound SS7/Diameter/GTP by attack category and block the dangerous ones.
• Detect roaming fraud — IRSF, Wangiri, SIMbox, SMS and location fraud — with rules and ML.
• Run a roaming incident — monitor the right KPIs, localize a cross-operator fault, and follow an on-call runbook.

Two operators, one subscriber

  Subscriber      Visited network (VPMN)     IPX      Home network (HPMN)
      |                    |                  |               |
      |---attach---------->|                  |               |     the UE is abroad
      |                    |---signalling---->|--DEA/SEPP---->|     border nodes screen it
      |                    |<----profile------|<--------------|     the home network authorizes
      #  DEA guards the Diameter border (4G); SEPP guards the SBI border (5G)

A roaming call spans two operators — know which network owns each leg.

Flow — the 4G roaming attach (S6a)

  MME (visited)        DEA (border)        HSS (home)
     |                    |                   |
     |--Auth-Info-Req---->|-------------------|-->                 give me a vector
     |<--Auth-Info-Ans----|<------------------|                    RAND/AUTN/XRES/K...
     |--Update-Location-->|-------------------|-->                 I am serving this user
     |<--Update-Loc-Ans---|<------------------|                    subscription data
     #  every message is realm-routed across operators — the DEA is the choke point

The 4G roaming attach: the visited network asks the home network to authorize the subscriber.

Three generations, three borders

  2G / 3G   SS7 / SIGTRAN     MAP + CAMEL           border:  SS7 firewall
  4G / EPC  Diameter          S6a / S8 / S9         border:  DEA + Diameter firewall
  5G / SA   HTTP/2 (SBI)      N32 via the SEPP      border:  SEPP (PRINS / TLS)

One subscriber, three generations of roaming signalling — and where the border control lives.

Defence — the signalling firewall

  inbound SS7 / Diameter / GTP message
     |
     +-- expected for this subscriber & location  ------> allow
     +-- category 1: should never cross a border  ------> block
     +-- category 2: only from the home network   ------> verify origin
     +-- category 3: plausible but abusable       ------> rate-limit + alert
     #  categories follow GSMA signalling-security guidance

The signalling firewall: classify every inbound cross-border message, then block the dangerous ones.

Voice roaming & the fraud you learn to catch

Voice roaming forks on where the media anchors — home-routed vs local breakout. The fraud module detects the classic roaming scams with rules and machine learning on synthetic call-detail records.

Module breakdown