A session border controller (SBC) is the device or software that connects a company's phone system to an operator's network, or to the internet, and protects the phone system while doing so. Every call passes through it. Almost every move from an old office PBX to the cloud passes through one.
The name describes the job. A session is one call, from its start to its end. The border is the edge between the company's network and the outside network. The controller decides which calls may cross that edge, and how.
Internet calls are set up with SIP, the Session Initiation Protocol. A protocol is an agreed set of messages. To start a call, one system sends a SIP message that names the caller and the number to be called. The line from the operator that carries these calls is called a SIP trunk. Without an SBC, the company's phone system would be open to the whole internet, and anyone could send it SIP messages.
The SBC does four main jobs. First, it hides the company's internal network. Outsiders see only the SBC's address, not the addresses of the phone system or the desk phones. Second, it checks every call request and drops the requests that do not come from the operator, or that look like an attack. Third, it converts between formats. The operator and the company may use different codecs, the methods that compress voice into data, so the SBC translates between them. Fourth, it enforces limits, such as the largest number of calls allowed at the same time.
Imagine a 500-bed hospital in Ludhiana. Its PBX and 800 desk phones were bought eight years ago, and they still work. The hospital wants to replace its old trunk lines with a cheaper SIP trunk, and later move to a cloud phone system. So it installs an SBC between the PBX and the internet. The SBC is set to allow 60 calls at the same time, the size of the new trunk. One night at 2 a.m., the SBC receives hundreds of call requests from an unknown address. They try to place calls to expensive international numbers through the hospital's line. This is called toll fraud, and the hospital would have to pay for every call. The requests do not come from the operator's address, so the SBC drops all of them.
Operators run SBCs too, at the edge of their own networks, beside core systems such as the packet core that carry mobile traffic. Calls between the two networks travel as VoIP.
An SBC is different from a next-generation firewall. A firewall checks every kind of traffic in a general way. An SBC understands the details of phone calls: who is calling, which number is dialled, which codec is used and how many calls are open.