Skip to main content

HSS — Home Subscriber Server

The HSS (Home Subscriber Server) is the master subscriber database for the mobile core. It holds every subscriber's identities (IMSI, MSISDN and SIM/ICCID), the authentication key material that proves who they are, and the EPC, IMS, PCRF and roaming service profiles that describe what each subscriber is allowed to do on the network. The MME reads it over S6a to authenticate and locate a device and to learn its EPC subscription; the CSCF reads it over Cx for IMS registration and iFC service triggers; and the PCRF draws its policy and charging rules from it. Its dashboard is where an operator provisions and searches subscribers, curates the shared service profiles, and checks the HSS's own health.

← Operations Guide

The dashboard is a per‑instance element page reached from the sidebar when an HSS runs in the site's inventory. All traffic goes through the OmniWeb backend proxy to the HSS's API, so it stays behind the single authenticated gateway; responses come back in a {status, response} envelope. A documentation link in the page header gives in‑context help. The page is organised into tabs.

Subscribers​

The HSS Subscribers tab with a search box for IMSI, MSISDN or ICCID and the resulting subscriber list

The landing tab is the subscriber directory. Search by IMSI, MSISDN or ICCID to find a record — the search also resolves a subscriber by IP address when a live session is being traced back to its owner. Opening a record shows the subscriber overview: a relationship diagram tying the subscriber to its identity (IMSI), its status (enabled, and whether IMS is enabled), and the EPC, IMS and roaming profiles assigned to it, with the profile's APNs shown beneath the EPC profile. Sensitive key values are held but not displayed — they can be updated but read back as redacted.

Provisioning​

The HSS provisioning form with subscriber identity, authentication key set, SIM card, phone numbers and profile assignment sections

Creating or editing a subscriber is done from the provisioning form, which brings the identity, credentials, SIM and profiles together in one place:

  • Subscriber identity — IMSI, a subscriber name, and the enabled and IMS‑enabled switches.
  • Authentication key set — the authentication algorithm, Ki and OPc (or OP), AMF, SQN, and the SIP password used for IMS.
  • SIM card — the ICCID, whether it is an eSIM, the PIN/PUK values and the batch and vendor details.
  • Phone numbers — assign one or more MSISDNs, searching existing numbers as you type so a number is not created twice.
  • Assign profiles — attach the EPC, IMS and roaming profiles that give the subscriber its service.

Existing subscribers can be updated the same way, and a subscriber can be deleted from its record.

SIMs​

The HSS SIMs tab listing the SIM inventory with ICCID, eSIM flag, batch and vendor, and the key‑set and ADM‑key detail

The SIM inventory — every SIM the HSS knows, searchable by ICCID. Each SIM carries its ICCID, eSIM flag, batch name and vendor, its transport‑key values (KIC, KID) and eSIM LPA, and the full set of ADM keys. The authentication key sets that back the SIMs (Ki/OPc/AMF/SQN) are managed here as the credential store the subscriber records reference. SIMs can be created, edited and deleted.

MSISDNs​

The HSS MSISDNs tab with a digit search box and the list of provisioned phone numbers

The MSISDN directory — the pool of provisioned phone numbers. Search by digits for a partial match to find or check a number before assigning it. Numbers can be created, edited and deleted, and are attached to subscribers during provisioning.

Service profiles​

Service profiles are the reusable building blocks that describe what a subscriber can do; a subscriber references them rather than carrying its own copy, so a change to a profile applies to everyone using it.

EPC profiles​

The HSS EPC Profiles tab showing profile settings and the assigned APN profiles

The packet‑core subscription the MME enforces. An EPC profile sets the network access mode, the UE‑AMBR downlink/uplink aggregate bandwidth, the TAU interval, and the list of APN profiles the subscriber may use, with one nominated as the default APN. Each APN profile ties an APN identifier to an APN QoS profile and a PCRF profile, and can be marked as the default. An EPC profile must reference at least one APN profile, and the default APN must be one of the assigned APNs.

Expanding an EPC profile lists its APN profiles. Add APN attaches an APN to the profile, and the unlink action on each row removes it from this EPC profile only — the APN profile itself is kept and can be re‑added later or reused by other EPC profiles. Because a profile must keep at least one APN, the last one cannot be removed. The default APN is cleared automatically if the APN it pointed at is removed.

APN Profiles​

The APN Profiles tab lists every APN profile independently of the EPC profiles that use it, and shows its APN identifier, APN QoS profile and PCRF profile. The Used By column names each EPC profile that references the APN, or marks it Orphaned when no EPC profile does — the state an APN reaches once it is removed from the last EPC profile that used it. The Orphaned only toggle filters the list to just those, so unused APNs can be found and cleaned up.

Profiles can be created here (a new profile starts unattached — link it to a subscriber's service by adding it to an EPC profile), edited, and deleted. An APN profile that is still linked to one or more EPC profiles cannot be deleted; remove it from those profiles first, then delete it from this tab.

APN QoS Profiles​

The HSS APN QoS Profiles tab listing the reusable QoS templates with their QCI, ARP, pre-emption flags, APN-AMBR downlink and uplink rates and charging state

The APN QoS Profiles tab manages the reusable APN-level QoS templates that EPC and APN profiles point at, so that every subscriber whose APN references a template gets the same quality of service on its default bearer. Each template carries a name, a QCI (the QoS Class Identifier that maps the bearer to a standardised delay and loss behaviour), an ARP — the allocation/retention priority, with pre-emption capability and pre-emption vulnerability flags that decide whether the bearer may bump, or be bumped by, others when resources are scarce — the APN-AMBR uplink and downlink aggregate rates, and whether online and offline charging are enabled.

Templates can be created, edited, cloned to derive a new variant, and deleted. Because an APN profile references a QoS template rather than carrying its own copy, editing a template re-shapes the QoS of every APN that uses it, and a template that is still referenced by an APN profile cannot be deleted until those APNs are reassigned first.

APN QoS profiles​

The per‑APN quality‑of‑service settings an APN profile points at: the QCI, ARP and pre‑emption capability/vulnerability, the APN‑AMBR downlink/uplink bandwidth, and whether online (Gy) and offline (Rf) charging apply. Profiles can be cloned to derive a new variant from an existing one.

IMS profiles​

The HSS IMS Profiles tab showing profiles and their iFC template

The IMS subscription the CSCF reads over Cx. An IMS profile carries an iFC template — the initial‑Filter‑Criteria that decide which application servers a subscriber's SIP traffic is routed to. Profiles can be created, edited and deleted.

Static IPs​

Fixed IP allocations for subscribers that must always receive the same address, managed alongside the EPC subscription data.

PCRF​

The HSS PCRF tab showing the relationship between PCRF profiles, charging rules and flow‑information rules

The policy layer the PCRF applies. A relationship view links the three parts:

  • PCRF profiles — the named policy a subscriber's APN references, made up of a set of charging rules.
  • Charging rules — each with a rule type and precedence, a QCI and ARP, MBR/GBR downlink/uplink limits, and a rating group and service identifier for charging; a rule with an MBR or GBR is carried on a dedicated bearer.
  • Flow‑information rules — the traffic flow templates attached to a charging rule that define which packets it matches.

All three can be created, edited and deleted; editing a charging rule affects every profile that uses it.

Roaming​

The HSS Roaming Profiles tab showing roaming profiles and their per‑network rules

The roaming policy the HSS applies to inbound and outbound subscribers. A roaming profile sets a default data action and default IMS action and a list of roaming rules; each rule keys off an MCC/MNC and sets the data and IMS action for that network, so specific visited networks can be allowed or blocked while the profile default covers the rest. An operator lookup finds a network's MCC/MNC from an operator name (from IR.21) when adding a rule. Rules are shared — editing a rule affects every profile that uses it.

EIR​

The HSS EIR tab listing equipment identity rules matching IMEI patterns to an action

The Equipment Identity Register. Each EIR rule matches an IMEI by regular expression and sets an action — allow or block — so a device model or a specific handset can be barred from the network. A device‑model search helps build the IMEI pattern. Rules can be created, edited and deleted.

Status​

The HSS Status tab showing API, database and license health and the subscriber, profile, SIM and MSISDN counts

A single‑screen health read of the HSS itself: the API, database and license health, and the entity counts — total subscribers, EPC profiles, IMS profiles, SIMs, MSISDNs and roaming profiles. It is the quickest confirmation that the HSS is up and how much it is carrying. Monitoring and statistics dashboards are provided as Grafana embeds.

The Replication tab shows the status of database replication to any peer HSS instances, and the Logs tab tails the HSS's live log output for troubleshooting a single instance without leaving OmniWeb.

Replication​

The HSS Replication tab showing a topology of HSS database nodes with a primary feeding one or more standbys, each link labelled with its replication lag and streaming state

The Replication tab reads the PostgreSQL replication health of the HSS node's subscriber database and draws it as a live topology. Each node shows whether its database is a primary or a standby — a standby being a node that is in recovery, replaying the primary's changes rather than accepting writes of its own. For a primary, every connected standby is drawn as a downstream link labelled with the standby's client address, the replication slot it streams through, its streaming state, and the replication lag measured against the primary's current WAL position — shown in bytes so a replica that is falling behind stands out at a glance. Whether each replication slot is currently active determines whether its link reads as healthy or broken.

This is how an operator confirms that the subscriber database is replicating across the HSS cluster — that a change provisioned on one node will reach the others, and that there is a standby to fail over to. A lagging replica shows a growing lag figure; a broken or disconnected one drops its link, and if two or more HSS instances are running but none of them replicate, the tab flags the whole cluster as a replication gap so it can be corrected before it becomes a data-loss risk.

Operations​

Two subscriber‑level operations act on a live session rather than on the stored record:

  • Cancel‑Location (CLR) — send an S6a Cancel‑Location‑Request to a subscriber's serving MME, detaching the subscriber so it re‑attaches and picks up changed subscription data.
  • PCRF Re‑Auth — request that a subscriber be re‑authorised for a given PDN session, pushing updated policy or charging rules onto an active session.
  • MME — reads subscriber authentication and EPC subscription data over S6a; the target of a Cancel‑Location.
  • CSCF — reads the IMS profile and iFC over Cx for IMS registration and service triggering.
  • PCRF / PCF — applies the PCRF profiles, charging rules and flow rules held here; the target of a Re‑Auth.
  • UDR — the shared subscriber data store the HSS front‑ends in a 5G core.
  • Operations Guide — back to the element index.
Last updated on