The Advanced Intelligent Network—A Security Opportunity

The public switched telephone network (PSTN) is evolving from a closed network made up of specialized equipment into an open network employing many of the same components and protocols that are used in the Internet. The security vulnerabilities of the Internet are well known. The possible introduction of these vulnerabilities into the PSTN provides opportunities—for hackers to exploit the vulnerabilities and for security professionals to eliminate them. The current PSTN is evolving into what is known as the Advanced Intelligent Network (AIN). In the old PSTN, the control functions for telephone services (service logic) are implemented in software that runs in telephone switches. In the AIN, service logic is implemented by Service Logic Programs (SLPs) that run in Service Control Points (SCPs). SCPs are, in most cases, ordinary commercially available microprocessor-based workstations or servers, running the same insecure operating systems that are used on most Internet hosts. SCPs communicate with switches through the SS7 network. In addition, SCPs will have connections (sometimes via other machines) to the telephone companies' corporate data networks to support such functions as customer service and billing. There are also plans to offer customers an Internet interface for changing their service parameters—such as the number to which their calls should be forwarded. The obvious and very interesting potential security problems created by these changes in the PSTN have received comparatively little attention from the information security community. It is the objective of this paper to change that.