CX Interface [CSCF <--> HSS]

Idea of this article is to give the gist of Cx interface. Cx interface is used between CSCF(I,S) and HSS. Before going to further details it would be better if we shall have a little idea about IMS Architecture in respect of Cx Interface.

CSCF, HSS and AS are the 3 major entities in IMS. CSCF and HSS uses the Cx Interface to communicate with each other. CSCF( Call Session and Control Function) has 3 entities(P,S and I) P-CSCF (Proxy-CSCF) is used when a call enters in Network it act as Gateway of Roam domain and shall tell which S-CSCF (Serving-CSCF) shall be used to fulfill the requirements of incoming call and forwards the call/message to S-CSCF. S-CSCF interact with HSS to know what all facilities/services this subscriber is allowed to use in its subscription and provide accordingly. If P-CSCF shall not have an information about the S-CSCF that will fulfill the call then P-CSCF takes help of I-CSCF (Interrogatory-CSCF) to select S-CSCF. Now I-CSCF interact with HSS to get the information of best suitable S-CSCF and tell to P-CSCF. 

S-CSCF and I-CSCF intract with HSS on Cx interface with following messages have Cx Application-Id 16777216.

1) I-CSCF and HSS

   a)User-Authorization-Request/Answer (I-CSCF ---> HSS) : This message is used to check whether an identity is allowed to roam or not.
   b)Location Info Request/Answer (I-CSCF ---> HSS) : This message is used to know the identity(Name) of S-CSCF is used to fulfill the call

2) S-CSCF and HSS

   a)Multimedia-Auth-Request/Answer (S-CSCF ---> HSS): This message is used to authenticate the subscriber's identity as well as the subscriber's network
   b)Server-Assignment-Request/Answer (S-CSCF ---> HSS): This message is used to download subscription profile at S-SCSCF.
   c)Push-Profile-Request/Answer(HSS ---> S-CSCF): This message is used to download the updated profile on S-CSCF if profile is changed by administrator at HSS.
   d)Registration-Termination-Request/Answer (HSS ---> S-CSCF): This message is used for administrative de-registration of a subscriber.

Your Comments /Suggestions and Questions are always welcome. We would try to clear your doubts with best of our knowledge. So feel free to put Questions.


  1. Hi Could you let me know some examples for PPR/PPA. Also when RTR is triggered some more live examples would really make very much useful.

    1. Dear Vinod,
      PPR and RTR both are administrative Request message to tell corresponding entities to update same.
      In PPR we push changes to SCSCF for user profile information and/or charging information and/or SIP Digest authentication information.
      IN RTR we push changes for Deregistartion of IMPU.

      If you want any specific knowledge, i would like to help you.

  2. Hi,

    Can anyone share sample captures for Cx interface. It will be of great help to me.

  3. Could Any body share the internal message header of the CX message between i-cscf/S-cscf and HSS

  4. Hi Team,

    What result code should be returned by HSS when Auth Item calculation fails, Can
    DIAMETER_AUTHENTICATION_DATA_UNAVAILABLE (4181) be sent in Experimental-Result-Code like S6a interface?

    4181 is not specified in Cx 3gpp 29.228.

    1. Hello Bhushan,

      Response from HSS & UE are matched at MME/S-CSCF to check authentication.
      If There is failure in vector generation at HSS. It would be better HSS send UNABLE_TO_COMPLY.

  5. Thanks for great articles.
    Are these interfaces used in sequence as described? I mean, Zh, Cx and Sh? I'd like to understand the complete sequence of interfaces used once UE is starting Attach procedure (i.e. S6a, then what Gx?, Cx?, Sh? etc.). If you could put a reference to such a flow description that will be helpful.

    1. Hello Dave,
      On access side UE interacts eNodeB & MME. while on core side MME interacts S-GW/P-GW/PCRF/HSS.
      While in attach procedure radio comes in picture where HSS is used for authentication purpose. While for registration in core network eg.IMS CX/Sh messages flow comes in picture.
      There are flow specific to network deployment architecture. Standard call flows are for first registrations. Rest all flows could be deployment specific (eg. ReReg, TPR).

      Feel free to ask specific call flow questions.

  6. Thank you Ajay,
    I know implementations vary but typically - from interfaces/call flow, I see similar logics being used. All I am asking is (even if generic) what triggers a sequence of call flows. So this is past S6a authentication (meaning, device is already attached and authenticated).
    Now, focusing on VoLTE, if a Gx call is initiated and PCEF has received rules from PCRF, what differing events would trigger the next call/s, say an Rx, and then Cx, Sh, etc..

    Again thanks very much for your help.

  7. hi,While UE is doing De-registration why P-CSCF will do DNS again,because they know S-cscf address.

    1. Hi sandeep,
      Sorry for late reply.

      DNS query at P-CSCF resolves the domain to I-CSCF. This request is sent to the same P-CSCF with which UE initially registered. I-CSCF queries HSS for S-CSCSF address in UAR.

      I suggest you to go through again with complete Call flow. As S-CSCF could keep some internal policies (proprietary) as per deployment architecture to save network traffic.

      If you need more details ask again with all confusions, which will help you to understand better.

    2. HI ,
      i got the answer,P-cscf will do dns query for all type of REGISTER header messages.

  8. Can I get the pcap messages for IMS registration towards HSS diameter protocol