Peer behind the magic curtain at how IMS networks route your VoLTE and VoNR calls, and how iFC (Initial Filter Criteria) achieve this.
Tag Archives: HSS
PyHSS Update – YAML Config Files
Introducing YAML based config files for defining how PyHSS should be setup
PyHSS Update – SCTP Support
Info on PyHSS new support for SCTP as well as TCP.
PyHSS New Features
Thanks to some recent developments, PyHSS has had a major overhaul recently, and is getting better than ever, Some features that are almost ready for public release are: Config File Instead of having everything defined all over the place a single YAML config file is used to define how the HSS should function. SCTP Support … Continue reading PyHSS New Features
Diameter and SIP: Registration-Termination-Request / Answer
These posts focus on the use of Diameter and SIP in an IMS / VoLTE context, however these practices can be equally applied to other networks. The Registration-Termination Request / Answer allow a Diameter Client (S-CSCF) to indicate to the HSS (Diameter Server) that it is no longer serving that user and the registration has … Continue reading Diameter and SIP: Registration-Termination-Request / Answer
Diameter and SIP: User-Authorization-Request/Answer
These posts focus on the use of Diameter and SIP in an IMS / VoLTE context, however these practices can be equally applied to other networks.
The Diameter User-Authorization-Request and User-Authorization-Answer commands are used as the first line of authorization of a user and to determine which Serving-CSCF to forward a request to.
Basics
When a SIP Proxy (I-CSCF) receives an incoming SIP REGISTER request, it sends a User-Authorization-Request to a Diameter server to confirm if the user exists on the network, and which S-CSCF to forward the request to.
When the Diameter server receives the User-Authorization-Request it looks at the User-Name (1) AVP to determine if the Domain / Realm is served by the Diameter server and the User specified exists.
Assuming the user & domain are valid, the Diameter server sends back a User-Authorization-Answer, containing a Server-Capabilities (603) AVP with the Server-Name of the S-CSCF the user will be served by.
I always find looking at the packets puts everything in context, so here’s a packet capture of both the User-Authorization-Request and the User-Authorization-Answer.
Wireshark display of User-Authorization-Request packet 
Wireshark display of User-Authorization-Answer packet
First Registration
If this is the first time this Username / Domain combination (Referred to in the RFC as an AOR – Address of Record) is seen by the Diameter server in the User-Authorization-Request it will allocate a S-CSCF address for the subscriber to use from it’s pool / internal logic.
The Diameter server will store the S-CSCF it allocated to that Username / Domain combination (AoR) for subsequent requests to ensure they’re routed to the same S-CSCF.
The Diameter server indicates this is the first time it’s seen it by adding the DIAMETER_FIRST_REGISTRATION (2001) AVP to the User-Authorization-Answer.
Subsequent Registration
If the Diameter server receives another User-Authorization-Request for the same Username / Domain (AoR) it has served before, the Diameter server returns the same S-CSCF address as it did in the first User-Authorization-Answer.
It indicates this is a subsequent registration in much the same way the first registration is indicated, by adding an DIAMETER_SUBSEQUENT_REGISTRATION (2002) AVP to the User-Authorization-Answer.
User-Authorization-Type (623) AVP
An optional User-Authorization-Type (623) AVP is available to indicate the reason for the User-Authorization-Request. The possible values / reasons are:
- Creating / Updating / Renewing a SIP Registration (REGISTRATION (0))
- Establishing Server Capabilities & Registering (CAPABILITIES (2))
- Terminating a SIP Registration (DEREGISTRATION (1))
If the User-Authorization-Type is set to DEREGISTRATION (1) then the Diameter server returns the S-CSCF address in the User-Authorization-Answer and then removes the S-SCSF address it had associated with the AoR from it’s own records.
Other Diameter Cx (IMS) Calls
User-Authorization-Request / User-Authorization-Answer
Server-Assignment-Request / Server-Assignment-Answer
Location-Info-Request / Location-Info-Answer
Multimedia-Auth-Request / Multimedia-Auth-Answer
Registration-Termination-Request / Registration-Termination-Answer
Push-Profile-Request / Push-Profile-Answer
References:
RFC 4740 – Diameter Session Initiation Protocol (SIP) Application
Diameter and SIP: Server-Assignment-Request/Answer
These posts focus on the use of Diameter and SIP in an IMS / VoLTE context, however these practices can be equally applied to other networks. The Server-Assignment-Request/Answer commands are used so a SIP Server can indicate to a Diameter server that it is serving a subscriber and pull the profile information of the subscriber. … Continue reading Diameter and SIP: Server-Assignment-Request/Answer
Diameter and SIP: Location-Info-Request / Answer
These posts focus on the use of Diameter and SIP in an IMS / VoLTE context, however these practices can be equally applied to other networks. The Location-Information-Request/Answer commands are used so a SIP Server query a Diameter to find which P-CSCF a Subscriber is being served by Basics: The RFC’s definition is actually pretty … Continue reading Diameter and SIP: Location-Info-Request / Answer
Diameter and SIP: Multimedia-Authentication-Request/Answer
These posts focus on the use of Diameter and SIP in an IMS / VoLTE context, however these practices can be equally applied to other networks.
The Multimedia-Authentication-Request/Answer commands are used to Authenticate subscribers / UAs using a variety of mechanisms such as straight MD5 and AKAv1-MD5.
Basics:
When a SIP Server (S-CSCF) receives a SIP INVITE, SIP REGISTER or any other SIP request, it needs a way to Authenticate the Subscriber / UA who sent the request.
We’ve already looked at the Diameter User-Authorization-Request/Answer commands used to Authorize a user for access, but the Multimedia-Authentication-Request / Multimedia-Authentication-Answer it used to authenticate the user.
The SIP Server (S-CSCF) sends a Multimedia-Authentication-Request to the Diameter server, containing the Username of the user attempting to authenticate and their Public Identity.
The Diameter server generates “Authentication Vectors” – these are Precomputed cryptographic challenges to challenge the user, and the correct (“expected”) responses to the challenges. The Diameter puts these Authentication Vectors in the 3GPP-SIP-Auth-Data (612) AVP, and sends them back to the SIP server in the Multimedia-Authentication-Answer command.
The SIP server sends the Subscriber / UA a SIP 401 Unauthorized response to the initial request, containing a WWW-Authenticate header containing the challenges.
The Subscriber / UA sends back the initial request with the WWW-Authenticate header populated to include a response to the challenges. If the response to the challenge matches the correct (“expected”) response, then the user is authenticated.
Multimedia-Authentication-Request Multimedia-Authentication-Answer
I always find it much easier to understand what’s going on through a packet capture, so here’s a packet capture showing the two Diameter commands,
Diameter – Multimedia-Authentication-Request and Multimedia-Authentication-Answer Packet CaptureDownload
Note: There is a variant of this process allows for stateless proxies to handle this by not storing the expected authentication values sent by the Diameter server on the SIP Proxy, but instead sending the received authentication values sent by the Subscriber/UA to the Diameter server to compare against the expected / correct values.
The Cryptography
The Cryptography for IMS Authentication relies on AKAv1-MD5 which I’ve written about before,
Essentially it’s mutual network authentication, meaning the network authenticates the subscriber, but the subscriber also authenticates the network.
Other Diameter Cx (IMS) Calls
User-Authorization-Request / User-Authorization-Answer
Server-Assignment-Request / Server-Assignment-Answer
Location-Info-Request / Location-Info-Answer
Multimedia-Auth-Request / Multimedia-Auth-Answer
Registration-Termination-Request / Registration-Termination-Answer
Push-Profile-Request / Push-Profile-Answer
References:
RFC 4740 – Diameter Session Initiation Protocol (SIP) Application
Connecting any 3rd Party HSS to Open5GS MME
Connecting an external / 3rd party HSS to Open5GS
PyHSS Update – IMS Cx Support!
An update to PyHSS to support IMS Authentication for VoLTE
PyHSS Update – MongoDB Backend & SQN Resync
Feature Update on PyHSS the Python Home Subscriber Server
Querying Auth Credentials from USIM/SIM cards
Using osmo-sim-auth to query USIM/SIM cards authentication mechanism.
HSS & USIM Authentication in LTE/NR (4G & 5G)
Exploring the how and why of Authentication in LTE & NR networks.
Subscribed-Periodic-RAU-TAU-Timer
Periodic Tracking Area Update timer purpose
Open5Gs- Python HSS Interface
Note: NextEPC the Open Source project rebranded as Open5Gs in 2019 due to a naming issue. The remaining software called NextEPC is a branch of an old version of Open5Gs. This post was written before the rebranding. I’ve been working for some time on Private LTE networks, the packet core I’m using is NextEPC, it’s … Continue reading Open5Gs- Python HSS Interface
PyHSS – Python 3GPP LTE Home Subscriber Server
I recently started working on an issue that I’d seen was to do with the HSS response to the MME on an Update Location Answer. I took some Wireshark traces of a connection from the MME to the HSS, and compared that to a trace from a different HSS. (Amarisoft EPC/HSS) The Update Location Answer … Continue reading PyHSS – Python 3GPP LTE Home Subscriber Server
Random Posts on
16 in 1 Magic SIM Card Revisited
Connecting to a Huawei BTS3900
An intro to GSMA TAP3 Files
Kamailio 101 – Part 4 – SIP Registrar
Improving WiFi Calling quality for WiFi Operators
RTPengine – Installation & Configuration (Ubuntu 20.04 / 22.04)
Scratch’n’Sniff – An easy tool for remote Packet Captures
Kamailio 101 – Part 1 – Introduction
Diameter Agents
