Skip to main content

HSS — Home Subscriber Server

The HSS (Home Subscriber Server) is the master subscriber database for the mobile core. It holds every subscriber's identities (IMSI, MSISDN and SIM/ICCID), the authentication key material that proves who they are, and the EPC, IMS, PCRF and roaming service profiles that describe what each subscriber is allowed to do on the network. The MME reads it over S6a to authenticate and locate a device and to learn its EPC subscription; the CSCF reads it over Cx for IMS registration and iFC service triggers; and the PCRF draws its policy and charging rules from it. Its dashboard is where an operator provisions and searches subscribers, curates the shared service profiles, and checks the HSS's own health.

← Operations Guide

The dashboard is a per‑instance element page reached from the sidebar when an HSS runs in the site's inventory. All traffic goes through the OmniWeb backend proxy to the HSS's API, so it stays behind the single authenticated gateway; responses come back in a {status, response} envelope. A documentation link in the page header gives in‑context help. The page is organised into tabs.

Subscribers​

The HSS Subscribers tab with a search box for IMSI, MSISDN or ICCID and the resulting subscriber list

The landing tab is the subscriber directory. Search by IMSI, MSISDN or ICCID to find a record — the search also resolves a subscriber by IP address when a live session is being traced back to its owner. Opening a record shows the subscriber overview: a relationship diagram tying the subscriber to its identity (IMSI), its status (enabled, and whether IMS is enabled), and the EPC, IMS and roaming profiles assigned to it, with the profile's APNs shown beneath the EPC profile. Sensitive key values are held but not displayed — they can be updated but read back as redacted.

Provisioning​

The HSS provisioning form with subscriber identity, authentication key set, SIM card, phone numbers and profile assignment sections

Creating or editing a subscriber is done from the provisioning form, which brings the identity, credentials, SIM and profiles together in one place:

  • Subscriber identity — IMSI, a subscriber name, and the enabled and IMS‑enabled switches.
  • Authentication key set — the authentication algorithm, Ki and OPc (or OP), AMF, SQN, and the SIP password used for IMS.
  • SIM card — the ICCID, whether it is an eSIM, the PIN/PUK values and the batch and vendor details.
  • Phone numbers — assign one or more MSISDNs, searching existing numbers as you type so a number is not created twice.
  • Assign profiles — attach the EPC, IMS and roaming profiles that give the subscriber its service.

Existing subscribers can be updated the same way, and a subscriber can be deleted from its record.

SIMs​

The HSS SIMs tab listing the SIM inventory with ICCID, eSIM flag, batch and vendor, and the key‑set and ADM‑key detail

The SIM inventory — every SIM the HSS knows, searchable by ICCID. Each SIM carries its ICCID, eSIM flag, batch name and vendor, its transport‑key values (KIC, KID) and eSIM LPA, and the full set of ADM keys. The authentication key sets that back the SIMs (Ki/OPc/AMF/SQN) are managed here as the credential store the subscriber records reference. SIMs can be created, edited and deleted.

MSISDNs​

The HSS MSISDNs tab with a digit search box and the list of provisioned phone numbers

The MSISDN directory — the pool of provisioned phone numbers. Search by digits for a partial match to find or check a number before assigning it. Numbers can be created, edited and deleted, and are attached to subscribers during provisioning.

Service profiles​

Service profiles are the reusable building blocks that describe what a subscriber can do; a subscriber references them rather than carrying its own copy, so a change to a profile applies to everyone using it.

EPC profiles​

The HSS EPC Profiles tab showing profile settings and the assigned APN profiles

The packet‑core subscription the MME enforces. An EPC profile sets the network access mode, the UE‑AMBR downlink/uplink aggregate bandwidth, the TAU interval, and the list of APN profiles the subscriber may use, with one nominated as the default APN. Each APN profile ties an APN identifier to an APN QoS profile and a PCRF profile, and can be marked as the default. An EPC profile must reference at least one APN profile, and the default APN must be one of the assigned APNs.

APN QoS profiles​

The per‑APN quality‑of‑service settings an APN profile points at: the QCI, ARP and pre‑emption capability/vulnerability, the APN‑AMBR downlink/uplink bandwidth, and whether online (Gy) and offline (Rf) charging apply. Profiles can be cloned to derive a new variant from an existing one.

IMS profiles​

The HSS IMS Profiles tab showing profiles and their iFC template

The IMS subscription the CSCF reads over Cx. An IMS profile carries an iFC template — the initial‑Filter‑Criteria that decide which application servers a subscriber's SIP traffic is routed to. Profiles can be created, edited and deleted.

Static IPs​

Fixed IP allocations for subscribers that must always receive the same address, managed alongside the EPC subscription data.

PCRF​

The HSS PCRF tab showing the relationship between PCRF profiles, charging rules and flow‑information rules

The policy layer the PCRF applies. A relationship view links the three parts:

  • PCRF profiles — the named policy a subscriber's APN references, made up of a set of charging rules.
  • Charging rules — each with a rule type and precedence, a QCI and ARP, MBR/GBR downlink/uplink limits, and a rating group and service identifier for charging; a rule with an MBR or GBR is carried on a dedicated bearer.
  • Flow‑information rules — the traffic flow templates attached to a charging rule that define which packets it matches.

All three can be created, edited and deleted; editing a charging rule affects every profile that uses it.

Roaming​

The HSS Roaming Profiles tab showing roaming profiles and their per‑network rules

The roaming policy the HSS applies to inbound and outbound subscribers. A roaming profile sets a default data action and default IMS action and a list of roaming rules; each rule keys off an MCC/MNC and sets the data and IMS action for that network, so specific visited networks can be allowed or blocked while the profile default covers the rest. An operator lookup finds a network's MCC/MNC from an operator name (from IR.21) when adding a rule. Rules are shared — editing a rule affects every profile that uses it.

EIR​

The HSS EIR tab listing equipment identity rules matching IMEI patterns to an action

The Equipment Identity Register. Each EIR rule matches an IMEI by regular expression and sets an action — allow or block — so a device model or a specific handset can be barred from the network. A device‑model search helps build the IMEI pattern. Rules can be created, edited and deleted.

Status​

The HSS Status tab showing API, database and license health and the subscriber, profile, SIM and MSISDN counts

A single‑screen health read of the HSS itself: the API, database and license health, and the entity counts — total subscribers, EPC profiles, IMS profiles, SIMs, MSISDNs and roaming profiles. It is the quickest confirmation that the HSS is up and how much it is carrying. Monitoring and statistics dashboards are provided as Grafana embeds.

The Replication tab shows the status of database replication to any peer HSS instances, and the Logs tab tails the HSS's live log output for troubleshooting a single instance without leaving OmniWeb.

Operations​

Two subscriber‑level operations act on a live session rather than on the stored record:

  • Cancel‑Location (CLR) — send an S6a Cancel‑Location‑Request to a subscriber's serving MME, detaching the subscriber so it re‑attaches and picks up changed subscription data.
  • PCRF Re‑Auth — request that a subscriber be re‑authorised for a given PDN session, pushing updated policy or charging rules onto an active session.
  • MME — reads subscriber authentication and EPC subscription data over S6a; the target of a Cancel‑Location.
  • CSCF — reads the IMS profile and iFC over Cx for IMS registration and service triggering.
  • PCRF / PCF — applies the PCRF profiles, charging rules and flow rules held here; the target of a Re‑Auth.
  • UDR — the shared subscriber data store the HSS front‑ends in a 5G core.
  • Operations Guide — back to the element index.
Last updated on