Signaling Firewall (SigFW)

signaling

Signaling firewall for SS7, Diameter, GTP-C/U, and 5G SBA traffic.

A multi-protocol signaling firewall covering SS7, Diameter, GTP-C/U, and 5G SBA, with category-based rules, cross-protocol correlation, and an operator-grade management UI.

SigFW inspects, filters, and protects SS7, Diameter, GTP-C, GTP-U, and 5G SBA (HTTP/2) signaling against fraud, surveillance, and denial-of-service attacks. Proprietary software jointly owned by H21 lab s.r.o. and P1 Security S.A.S., with a web management UI, REST APIs, Prometheus monitoring, and GSMA FS.11/19/20/36 compliance scanning.

What it does

• SS7 firewall: SCCP/TCAP/MAP/CAP/ISUP filtering with category-based rules (Cat0–CatR), DTLS encryption, and digital signatures.
• Diameter firewall: origin-realm blacklisting, application-ID whitelisting, command-code filtering, and Lua scripting.
• GTP-C and GTP-U firewalls: message-type filtering, IMSI/APN/TEID checks, and GTP-in-GTP detection.
• 5G SBA firewall: HTTP proxy with OAuth2/JWT validation, NF-type filtering, N32/SEPP support, and topology hiding.
• Rate limiting, circuit breaker, and EMA-based statistical anomaly detection per source.
• Cross-protocol IMSI correlation across SS7, Diameter, and GTP to surface multi-vector attack patterns.
• Prometheus metrics, Grafana dashboard, deep health checks, and automated GSMA FS.11/19/20/36 compliance scoring.
• Web management UI, REST API for dynamic rules, SSE event stream, config hot-reload, and bulk rule export/import.

Best for

• Mobile operator security teams evaluating signaling defences across SS7, Diameter, GTP, and 5G SBA.
• Researchers studying multi-protocol interconnect attacks.
• Trainers running interconnect-defence labs and red-team exercises.

Protocols: SS7, MAP, CAP, SCCP, TCAP, M3UA, SCTP, Diameter, GTP-C, GTP-U, 5G SBA, HTTP/2

Inputs: SS7 (SCTP/M3UA), Diameter (SCTP), GTP-C/U, 5G SBA (HTTP/2), JSON rule configs

Outputs: Filtered signaling, Drop/allow events, Prometheus metrics, Per-event PCAPs