USSD Study Guide

Unstructured Supplementary Service Data for Communication Engineering

1. Introduction to USSD

Definition: USSD (Unstructured Supplementary Service Data) is a session-based communications protocol defined in GSM standards that enables real-time exchange of short text-based information between a mobile station (MS) and a Public Land Mobile Network (PLMN) operator's application.

USSD represents one of the most significant Value Added Services (VAS) in mobile telecommunications. It provides a messaging service that is approximately seven times faster than SMS and highly cost-effective. The technology enables direct, real-time communication between mobile devices and network applications without requiring internet connectivity or smartphone capabilities.

Key Characteristics:

  • Session-based: Establishes real-time bidirectional connection between MS and network
  • Handset independent: Works on any GSM mobile device from basic feature phones to smartphones
  • No internet required: Operates over signaling channels
  • Interactive: Supports menu-driven dialogues and multi-turn conversations
  • Character limit: Maximum 182 alphanumeric characters using 7-bit encoding

Historical Evolution

Early 1990s

USSD initially standardized by ETSI in GSM 03.90 as part of GSM Phase 2 specifications

Mid-1990s

Network-initiated USSD introduced via MAP protocol, enabling push notifications from network to mobile station

Release 99 (2000)

Integration into 3GPP framework with TS 22.090 (Stage 1) and TS 24.090 (Stage 3) for UMTS compatibility

Releases 4-5 (2002)

USSD integrated into UMTS circuit-switched domain with enhanced session persistence

Release 11+

USSD over IMS (USSI) introduced for LTE and 5G compatibility through IP Multimedia Subsystem

Release 17 (2022)

TS 24.090 updated to Version 17.0.0 for ongoing maintenance with evolving network architectures

2. Fundamental Concepts

2.1 USSD Message Format

USSD messages follow a specific structure that is universally recognized across all GSM networks:

Format: [* or #] + [Service Code] + [Optional Data] + [#]
  • Start Character: Asterisk (*) or Hash (#)
  • Service Code: Numbers and sometimes letters identifying the service
  • End Character: Hash symbol (#) terminates the code
  • Maximum Length: 182 characters (7-bit encoding) or 160 characters (8-bit mode)

Common USSD Code Examples:

Code Pattern Example Function
*XXX# *123# Balance inquiry
*XXX*DATA# *555*1234# Recharge with code 1234
#XXX# #100# Check data balance
*#XXX# *#06# Display IMEI number

2.2 Session-Based Communication Model

Unlike SMS which operates on a store-and-forward model, USSD establishes a direct, two-way connection during the session. This session-based approach enables immediate responses and interactive menu-driven dialogues.

USSD Session Flow:

┌─────────────┐ REGISTER ┌─────────────┐
│ Mobile │ ───────────────────→ │ MSC │
│ Station │ │ /VLR │
│ (MS) │ ←─────────────────── │ │
└─────────────┘ FACILITY/RELEASE └─────────────┘
↑ │
│ ┌─────────────┐ │
└────────→│ HLR │←─────────┘
│ /APP Server│
└─────────────┘

Message Types: REGISTER (Initiate), FACILITY (Continue), RELEASE COMPLETE (End)

2.3 Encoding Schemes

USSD supports multiple character encoding schemes with different capacity implications:

Encoding Scheme Bits per Character Maximum Characters Use Case
GSM 7-bit Default Alphabet 7 bits 182 characters Latin-based scripts
8-bit Data 8 bits 160 characters Binary data, extended characters
UCS-2 (16-bit) 16 bits 70 characters Non-Latin languages, Arabic, Chinese

3. Network Architecture

3.1 GSM/UMTS Architecture Components

The USSD protocol architecture in GSM and UMTS networks involves several key network elements within the Public Land Mobile Network (PLMN):

Mobile Station
(MS/UE)
→
Base Station
(BTS/Node B)
→
MSC/VLR
→
HLR/USSD
Gateway
→
Application
Server

Core Network Elements:

  • Mobile Station (MS) / User Equipment (UE): User endpoint for initiating or responding to USSD dialogues
  • Base Station Subsystem (BSS) / UTRAN: Handles radio interface communication
  • Mobile Switching Center/Visitor Location Register (MSC/VLR): Handles call control and routing of USSD messages to appropriate network entities
  • Home Location Register (HLR): Maintains subscriber profiles and supports location updates relevant to USSD routing
  • USSD Gateway/Application Server: Processes USSD-specific logic such as service queries or responses

3.2 LTE/5G Architecture (USSI)

In LTE and 5G networks, USSD support extends through the IP Multimedia Subsystem (IMS) as specified in 3GPP TS 24.390. This evolution, known as USSD over IMS (USSI), enables USSD operations over IP for Voice over LTE (VoLTE) and 5G System (5GS) environments.

IMS-Based USSD Architecture (USSI):

┌─────────┐ SIP INVITE ┌─────────┐
│ UE │ ───────────────────→ │ P-CSCF │
│ │ (carrying USSD str) │ │
└─────────┘ └────┬────┘
│
┌─────────┐←─────────────────┘
│ S-CSCF │
└────┬────┘
│ SIP Routing
┌────┴─────────────────────┐
│ USSD Application │
│ Server (USSI AS) │
│ • XML encoding │
│ • SIP INFO methods │
│ • INVITE/BYE handling │
└────────────────────────────┘

3.3 Signaling Protocol Stack

USSD signaling relies on the Mobile Application Part (MAP) protocol layered over the Signaling System No. 7 (SS7) network:

Application Layer: USSD Application (Mobile Banking, Menu Services, etc.) ↓ MAP Layer: Mobile Application Part (ProcessUnstructuredSS-Request) ↓ TCAP Layer: Transaction Capabilities Application Part (Invoke/Result) ↓ SCCP Layer: Signaling Connection Control Part ↓ MTP Layer: Message Transfer Part (SS7) ↓ Physical Layer: E1/T1 Links, ATM, IP (SIGTRAN)

MAP Operations for USSD:

Operation Direction Description
processUnstructuredSS-Request MS → Network Mobile-initiated USSD request
unstructuredSS-Request Network → MS Network-initiated query requiring response
unstructuredSS-Notify Network → MS Network notification (no response needed)
unstructuredSS-Response MS → Network Mobile response to network request

4. Protocol Details

4.1 Dialogue Types

USSD supports two primary dialogue types that define the communication flow between mobile station and network:

1. Mobile-Initiated Dialogue (MO-USSD)

User dials a USSD code (e.g., *123#) to initiate a session. The MS sends a REGISTER message containing a ProcessUnstructuredSS-Request invoke component.

2. Network-Initiated Dialogue (MT-USSD)

Network pushes information to the MS using UnstructuredSS-Request or UnstructuredSS-Notify operations. Requires prior subscriber consent and registration.

4.2 Message Structure

USSD messages are encapsulated within MAP operations using ASN.1 (Abstract Syntax Notation One) encoding. The key parameters include:

USSD-Arg ::= SEQUENCE { ussd-DataCodingScheme DataCodingScheme, ussd-String USSD-String, alertingPattern AlertingPattern OPTIONAL, ... } DataCodingScheme ::= OCTET STRING (SIZE (1)) -- Bits 7-4: Coding Group -- Bits 3-0: Language/Character Set USSD-String ::= OCTET STRING -- Maximum 160 octets -- 7-bit: 182 chars, 8-bit: 160 chars, UCS-2: 70 chars

4.3 Session Management

USSD sessions are managed through specific signaling procedures:

Phase Message TCAP Component Description
Initiation REGISTER Invoke (Last) Start USSD dialogue
Continuation FACILITY Invoke/Return Result Continue dialogue
Termination RELEASE COMPLETE Return Result (Last) End session normally
Error RELEASE COMPLETE Return Error/Reject End with error code

4.4 Error Handling

Error handling in USSD incorporates invoke identifiers within facility messages to correlate requests and responses. Specific release causes are defined for issues like network busy conditions or facility rejection.

Common USSD Error Codes:

  • USSD-Busy: MS unable to process new USSD request while handling existing session
  • UnknownSubscriber: Subscriber not found in HLR/VLR
  • AbsentSubscriber: MS not reachable
  • FacilityNotSupported: Network or MS doesn't support requested facility
  • SystemFailure: Internal network error

5. Applications and Use Cases

5.1 Mobile Financial Services

USSD has revolutionized financial inclusion, particularly in developing regions. Mobile money services like M-Pesa grew rapidly because of USSD's simplicity and accessibility.

Banking Applications:

  • Account balance inquiries (*123#)
  • Fund transfers between accounts
  • Bill payments (utilities, credit cards)
  • Airtime purchase and top-up
  • Mobile wallet transactions
  • Transaction history requests

5.2 Telecommunications Services

Telcos were the first to popularize USSD for customer self-service:

Service Category USSD Function Example Code
Account Management Check balance, validity *123#
Recharge Top-up prepaid account *555*PIN#
Data Services Buy data bundles *100*4#
Call Services Call forwarding setup **21*number#
Customer Care Menu-based support *111#

5.3 IoT and Machine-to-Machine (M2M)

USSD has found new applications in IoT scenarios due to its low bandwidth requirements and universal compatibility:

  • Remote Device Management: Sending configuration updates to IoT devices
  • Data Collection: Gathering sensor readings from remote locations
  • Emergency Communications: Backup communication when data networks fail
  • Asset Tracking: Location updates from GPS-enabled devices
  • Smart Metering: Utility meter reading and control

5.4 Interactive Demo: USSD Menu Simulation

Try a USSD Banking Session:

Enter a USSD code to see how a typical mobile banking session works:

Enter a USSD code above and click "Dial" to see the session flow...

6. USSD vs. SMS Comparison

Understanding the differences between USSD and SMS is crucial for communication engineers designing mobile services:

Feature USSD SMS
Connection Type Session-based (real-time) Store-and-forward
Character Limit 182 characters (7-bit) 160 characters (7-bit)
Delivery Mechanism Immediate or fails Eventual delivery, queued
Internet Required No No
Smartphone Required No - works on all GSM phones No - works on all GSM phones
Cost Model Per-session charging Per-message charging
Interactivity Real-time two-way dialogue Asynchronous messaging
Session Persistence Connection remains open No session concept
Network Dependency Requires active network session Can be delivered later if phone off
Storage Not stored on phone/network Stored on phone and SMSC

When to Use USSD:

  • Real-time balance inquiries and quick transactions
  • Interactive menu-based services
  • Services requiring immediate confirmation
  • Applications targeting feature phone users
  • Low-bandwidth IoT communications

When to Use SMS:

  • Store-and-forward messaging
  • Delivery to offline subscribers
  • Broadcast and bulk messaging
  • Non-time-critical notifications
  • Applications requiring message persistence

7. Security Considerations

7.1 Security Architecture

USSD security relies on network-level authentication mechanisms, such as those tied to subscriber identity verification via the HLR, but lacks end-to-end encryption, leaving USSD data vulnerable to interception over SS7 links.

Security Vulnerabilities:

  • SS7/MAP Interception: USSD transmitted in plaintext over signaling protocols without built-in encryption
  • SIM Swap Attacks: Attackers exploit USSD codes to transfer phone numbers to attacker-controlled SIMs
  • Social Engineering: Malicious USSD codes can bypass two-factor authentication or gather account information
  • Man-in-the-Middle: Exploitation of weak authentication mechanisms in SS7 networks

7.2 Security Best Practices

Recommendations for Organizations:

  • Monitor USSD traffic for unusual patterns or unauthorized access attempts
  • Implement strong authentication for any USSD-based services
  • Educate users about USSD-based social engineering attacks
  • Regularly audit USSD code configurations and access controls
  • Deploy network monitoring tools to detect suspicious USSD activity
  • Implement USSD gateway firewalls to filter malicious codes

7.3 IMS Security Enhancements

In LTE/5G IMS-based USSD (USSI), security relies on IMS protections such as TLS for SIP signaling and authentication via the S-CSCF, but still provides no dedicated end-to-end encryption for USSD payloads.

8. Technical Standards and Specifications

8.1 3GPP Specifications

USSD is standardized under various 3GPP Technical Specifications:

Specification Title Scope
3GPP TS 22.090 Stage 1: Unstructured Supplementary Service Data (USSD) Service description and requirements
3GPP TS 24.090 Stage 3: USSD procedures Detailed procedures and message flows
3GPP TS 24.390 USSD over IMS (USSI) LTE/5G USSD implementation
3GPP TS 29.002 MAP Specification Mobile Application Part details
3GPP TS 23.039 Interface Protocols Technical realization

8.2 ETSI Standards

Originally standardized by ETSI in GSM 03.90, USSD specifications later evolved under 3GPP for UMTS and beyond.

8.3 Key Abbreviations

USSD - Unstructured Supplementary Service Data
USSDC - USSD Center
MS - Mobile Station
UE - User Equipment
MSC - Mobile Switching Center
VLR - Visitor Location Register
HLR - Home Location Register
MAP - Mobile Application Part
TCAP - Transaction Capabilities Application Part
SS7 - Signaling System No. 7
IMSI - International Mobile Subscriber Identity
IMEI - International Mobile Equipment Identity
PLMN - Public Land Mobile Network
HPLMN - Home PLMN
VPLMN - Visited PLMN
IMS - IP Multimedia Subsystem
USSI - USSD over IMS
S-CSCF - Serving Call Session Control Function
P-CSCF - Proxy-CSCF
SIP - Session Initiation Protocol
VAS - Value Added Services
MNO - Mobile Network Operator

9. Self-Assessment Quiz

Test your understanding of USSD concepts with these review questions:

1. What is the maximum number of characters supported by USSD using 7-bit GSM encoding?
2. Which protocol does USSD use in GSM/UMTS networks for signaling between network elements?
3. What is the primary difference between USSD and SMS communication models?
4. In LTE/5G networks, USSD is supported through which architecture?
5. What does the USSD code *#06# typically retrieve?

10. Summary and Key Takeaways

Core Concepts:

  • USSD is a session-based, real-time signaling protocol in GSM/UMTS networks enabling interactive text communication
  • Maximum message size is 182 characters (7-bit) or 160 octets
  • Uses MAP protocol over SS7 for core network signaling
  • Supports both mobile-initiated and network-initiated dialogues
  • Evolved to USSI (USSD over IMS) for LTE/5G compatibility
  • Critical for mobile banking, IoT, and services in low-connectivity regions
  • Security concerns include lack of end-to-end encryption and SS7 vulnerabilities

Study Recommendations

For further study, review the following 3GPP specifications:

  1. 3GPP TS 22.090 - Stage 1 service requirements
  2. 3GPP TS 24.090 - Stage 3 procedures and message flows
  3. 3GPP TS 24.390 - USSD over IMS for 4G/5G networks
  4. 3GPP TS 29.002 - MAP protocol specification