This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these template messages) This article may be too technical for most readers to understand. Please help improve it to make it understandable to non-experts, without removing the technical details. (December 2010) (Learn how and when to remove this message) This article may have confusing or ambiguous abbreviations. Please review the Manual of Style, help improve this article, and discuss this issue on the talk page. (May 2011) (Learn how and when to remove this message) (Learn how and when to remove this message)

The IP Multimedia Subsystem or IP Multimedia Core Network Subsystem (IMS) is a standardised architectural framework for delivering IP multimedia services. Historically, mobile phones have provided voice call services over a circuit-switched-style network, rather than strictly over an IP packet-switched network. Various voice over IP technologies are available on smartphones; IMS provides a standard protocol across vendors.

IMS was originally designed by the wireless standards body 3rd Generation Partnership Project (3GPP), as a part of the vision for evolving mobile networks beyond GSM. Its original formulation (3GPP Rel-5) represented an approach for delivering Internet services over GPRS. This vision was later updated by 3GPP, 3GPP2 and ETSI TISPAN by requiring support of networks other than GPRS, such as Wireless LAN, CDMA2000 and fixed lines.

IMS uses IETF protocols wherever possible, e.g., the Session Initiation Protocol (SIP). According to the 3GPP, IMS is not intended to standardize applications, but rather to aid the access of multimedia and voice applications from wireless and wireline terminals, i.e., to create a form of fixed-mobile convergence (FMC).[1] This is done by having a horizontal control layer that isolates the access network from the service layer. From a logical architecture perspective, services need not have their own control functions, as the control layer is a common horizontal layer. However, in implementation this does not necessarily map into greater reduced cost and complexity.

Alternative and overlapping technologies for access and provisioning of services across wired and wireless networks include combinations of Generic Access Network, softswitches and "naked" SIP.

Since it is becoming increasingly easier to access content and contacts using mechanisms outside the control of traditional wireless/fixed operators, the interest of IMS is being challenged.[2]

Examples of global standards based on IMS are MMTel which is the basis for Voice over LTE (VoLTE), Wi-Fi Calling (VoWIFI), Video over LTE (ViLTE), SMS/MMS over WiFi and LTE, USSD over LTE, and Rich Communication Services (RCS), which is also known as joyn or Advanced Messaging, and now RCS is operator's implementation. RCS also further added Presence/EAB (enhanced address book) functionality.[3]


Some operators opposed IMS because it was seen as complex and expensive. In response, a cut-down version of IMS—enough of IMS to support voice and SMS over the LTE network—was defined and standardized in 2010 as Voice over LTE (VoLTE).[6]


3GPP / TISPAN IMS architectural overview
3GPP / TISPAN IMS architectural overview – HSS in IMS layer (as by standard)

Each of the functions in the diagram is explained below.

The IP multimedia core network subsystem is a collection of different functions, linked by standardized interfaces, which grouped form one IMS administrative network.[7] A function is not a node (hardware box): An implementer is free to combine two functions in one node, or to split a single function into two or more nodes. Each node can also be present multiple times in a single network, for dimensioning, load balancing or organizational issues.

Access network

The user can connect to IMS in various ways, most of which use the standard IP. IMS terminals (such as mobile phones, personal digital assistants (PDAs) and computers) can register directly on IMS, even when they are roaming in another network or country (the visited network). The only requirement is that they can use IP and run SIP user agents. Fixed access (e.g., digital subscriber line (DSL), cable modems, Ethernet, FTTx), mobile access (e.g. 5G NR, LTE, W-CDMA, CDMA2000, GSM, GPRS) and wireless access (e.g., WLAN, WiMAX) are all supported. Other phone systems like plain old telephone service (POTS—the old analogue telephones), H.323 and non IMS-compatible systems, are supported through gateways.

Core network

HSS – Home subscriber server:
The home subscriber server (HSS), or user profile server function (UPSF), is a master user database that supports the IMS network entities that actually handle calls. It contains the subscription-related information (subscriber profiles), performs authentication and authorization of the user, and can provide information about the subscriber's location and IP information. It is similar to the GSM home location register (HLR) and Authentication centre (AuC).

A subscriber location function (SLF) is needed to map user addresses when multiple HSSs are used.

User identities:
Various identities may be associated with IMS: IP multimedia private identity (IMPI), IP multimedia public identity (IMPU), globally routable user agent URI (GRUU), wildcarded public user identity. Both IMPI and IMPU are not phone numbers or other series of digits, but uniform resource identifier (URIs), that can be digits (a Tel URI, such as tel:+1-555-123-4567) or alphanumeric identifiers (a SIP URI, such as" ).

IP Multimedia Private Identity:
The IP Multimedia Private Identity (IMPI) is a unique permanently allocated global identity assigned by the home network operator. It has the form of a Network Access Identifier(NAI) i.e., and is used, for example, for Registration, Authorization, Administration, and Accounting purposes. Every IMS user shall have one IMPI.

IP Multimedia Public Identity:
The IP Multimedia Public Identity (IMPU) is used by any user for requesting communications to other users (e.g. this might be included on a business card). Also known as Address of Record (AOR). There can be multiple IMPU per IMPI. The IMPU can also be shared with another phone, so that both can be reached with the same identity (for example, a single phone-number for an entire family).

Globally Routable User Agent URI:
Globally Routable User Agent URI (GRUU) is an identity that identifies a unique combination of IMPU and UE instance. There are two types of GRUU: Public-GRUU (P-GRUU) and Temporary GRUU (T-GRUU).

Wildcarded Public User Identity:
A wildcarded Public User Identity expresses a set of IMPU grouped together.

The HSS subscriber database contains the IMPU, IMPI, IMSI, MSISDN, subscriber service profiles, service triggers, and other information.

Call Session Control Function (CSCF)

Several roles of SIP servers or proxies, collectively called Call Session Control Function (CSCF), are used to process SIP signaling packets in the IMS.

Application servers

See also: Next generation network services

SIP Application servers (AS) host and execute services, and interface with the S-CSCF using SIP. An example of an application server that is being developed in 3GPP is the Voice call continuity Function (VCC Server). Depending on the actual service, the AS can operate in SIP proxy mode, SIP UA (user agent) mode or SIP B2BUA mode. An AS can be located in the home network or in an external third-party network. If located in the home network, it can query the HSS with the Diameter Sh or Si interfaces (for a SIP-AS).

Functional model

The AS-ILCM (Application Server - Incoming Leg Control Model) and AS-OLCM (Application Server - Outgoing Leg Control Model) store transaction state, and may optionally store session state depending on the specific service being executed. The AS-ILCM interfaces to the S-CSCF (ILCM) for an incoming leg and the AS-OLCM interfaces to the S-CSCF (OLCM) for an outgoing leg. Application Logic provides the service(s) and interacts between the AS-ILCM and AS-OLCM.

Public Service Identity

Public Service Identities (PSI) are identities that identify services, which are hosted by application servers. As user identities, PSI takes the form of either a SIP or Tel URI. PSIs are stored in the HSS either as a distinct PSI or as a wildcarded PSI:

Media servers

The Media Resource Function (MRF) provides media related functions such as media manipulation (e.g. voice stream mixing) and playing of tones and announcements.

Each MRF is further divided into a media resource function controller (MRFC) and a media resource function processor (MRFP).

The Media Resource Broker (MRB) is a functional entity that is responsible for both collection of appropriate published MRF information and supplying of appropriate MRF information to consuming entities such as the AS. MRB can be used in two modes:

Breakout gateway

A Breakout Gateway Control Function (BGCF) is a SIP proxy which processes requests for routing from an S-CSCF when the S-CSCF has determined that the session cannot be routed using DNS or ENUM/DNS. It includes routing functionality based on telephone numbers.

PSTN gateways

A PSTN/CS gateway interfaces with PSTN circuit switched (CS) networks. For signalling, CS networks use ISDN User Part (ISUP) (or BICC) over Message Transfer Part (MTP), while IMS uses SIP over IP. For media, CS networks use Pulse-code modulation (PCM), while IMS uses Real-time Transport Protocol (RTP).

Media resources

Media Resources are those components that operate on the media plane and are under the control of IMS core functions. Specifically, Media Server (MS) and Media gateway (MGW)

NGN interconnection

There are two types of next-generation networking interconnection:

An NGN interconnection mode can be direct or indirect. Direct interconnection refers to the interconnection between two network domains without any intermediate network domain. Indirect interconnection at one layer refers to the interconnection between two network domains with one or more intermediate network domain(s) acting as transit networks. The intermediate network domain(s) provide(s) transit functionality to the two other network domains. Different interconnection modes may be used for carrying service layer signalling and media traffic.


Offline charging is applied to users who pay for their services periodically (e.g., at the end of the month). Online charging, also known as credit-based charging, is used for prepaid services, or real-time credit control of postpaid services. Both may be applied to the same session.

Charging function addresses are addresses distributed to each IMS entities and provide a common location for each entity to send charging information. charging data function (CDF) addresses are used for offline billing and Online Charging Function (OCF) for online billing.

IMS-based PES architecture

IMS-based PES (PSTN Emulation System) provides IP networks services to analog devices. IMS-based PES allows non-IMS devices to appear to IMS as normal SIP users. Analog terminal using standard analog interfaces can connect to IMS-based PES in two ways:

Both A-MGW and VGW are unaware of the services. They only relay call control signalling to and from the PSTN terminal. Session control and handling is done by IMS components.

Interfaces description

TISPAN IMS architecture with interfaces
Interface name IMS entities Description Protocol Technical specification
Cr MRFC, AS Used by MRFC to fetch documents (e.g. scripts, announcement files, and other resources) from an AS. Also used for media control related commands. TCP/SCTP channels
Cx (I-CSCF, S-CSCF), HSS Used to send subscriber data to the S-CSCF; including filter criteria and their priority. Also used to furnish CDF and/or OCF addresses. Diameter TS29.229, TS29.212
Dh AS (SIP AS, OSA, IM-SSF) <-> SLF Used by AS to find the HSS holding the user profile information in a multi-HSS environment. DH_SLF_QUERY indicates an IMPU and DX_SLF_RESP return the HSS name. Diameter
Dx (I-CSCF or S-CSCF) <-> SLF Used by I-CSCF or S-CSCF to find a correct HSS in a multi-HSS environment. DX_SLF_QUERY indicates an IMPU and DX_SLF_RESP return the HSS name. Diameter TS29.229, TS29.212
Gm UE, P-CSCF Used to exchange messages between SIP user equipment (UE) or Voip gateway and P-CSCF SIP
Go PDF, GGSN Allows operators to control QoS in a user plane and exchange charging correlation information between IMS and GPRS network COPS (Rel5), diameter (Rel6+)
Gq P-CSCF, PDF Used to exchange policy decisions-related information between P-CSCF and PDF Diameter
Gx PCEF, PCRF Used to exchange policy decisions-related information between PCEF and PCRF Diameter TS29.211, TS29.212
Gy PCEF, OCS Used for online flow-based bearer charging. Functionally equivalent to Ro interface Diameter TS23.203, TS32.299
ISC S-CSCF <-> AS Reference point between S-CSCF and AS. Main functions are to :
  • Notify the AS of the registered IMPU, registration state and UE capabilities
  • Supply the AS with information to allow it to execute multiple services
  • Convey charging function addresses
Ici IBCFs Used to exchange messages between an IBCF and another IBCF belonging to a different IMS network. SIP
Izi TrGWs Used to forward media streams from a TrGW to another TrGW belonging to a different IMS network. RTP
Ma I-CSCF <-> AS Main functions are to:
  • Forward SIP requests which are destined to a public service identity hosted by the AS
  • Originate a session on behalf of a user or public service identity, if the AS has no knowledge of a S-CSCF assigned to that user or public service identity
  • Convey charging function addresses
Mg MGCF -> I,S-CSCF ISUP signalling to SIP signalling and forwards SIP signalling to I-CSCF SIP
Mi S-CSCF -> BGCF Used to exchange messages between S-CSCF and BGCF SIP
Mj BGCF -> MGCF Used for the interworking with the PSTN/CS domain, when the BGCF has determined that a breakout should occur in the same IMS network to send SIP message from BGCF to MGCF SIP
Mk BGCF -> BGCF Used for the interworking with the PSTN/CS domain, when the BGCF has determined that a breakout should occur in another IMS network to send SIP message from BGCF to the BGCF in the other network SIP
Mm I-CSCF, S-CSCF, external IP network Used for exchanging messages between IMS and external IP networks SIP
Mn MGCF, IM-MGW Allows control of user-plane resources H.248
Mp MRFC, MRFP Allows an MRFC to control media stream resources provided by an MRFP. H.248
Used to exchange information between S-CSCF and MRFC
Used to exchange session controls between AS and MRFC
Application server sends SIP message to MRFC to play tone and announcement. This SIP message contains sufficient information to play tone and announcement or provide information to MRFC, so that it can ask more information from application server through Cr Interface. SIP
Mw P-CSCF, I-CSCF, S-CSCF, AGCF Used to exchange messages between CSCFs. AGCF appears as a P-CSCF to the other CSCFs SIP
Mx BGCF/CSCF, IBCF Used for the interworking with another IMS network, when the BGCF has determined that a breakout should occur in the other IMS network to send SIP message from BGCF to the IBCF in the other network SIP
P1 AGCF, A-MGW Used for call control services by AGCF to control H.248 A-MGW and residential gateways H.248
P2 AGCF, CSCF Reference point between AGCF and CSCF. SIP
Rc MRB, AS Used by the AS to request that media resources be assigned to a call when using MRB in-line mode or in query mode SIP, in query mode (not specified)
Rf P-CSCF, I-CSCF, S-CSCF, BGCF, MRFC, MGCF, AS Used to exchange offline charging information with CDF Diameter TS32.299
Ro AS, MRFC, S-CSCF Used to exchange online charging information with OCF Diameter TS32.299
Rx P-CSCF, PCRF Used to exchange policy and charging related information between P-CSCF and PCRF

Replacement for the Gq reference point.

Diameter TS29.214
Sh AS (SIP AS, OSA SCS), HSS Used to exchange User Profile information (e.g., user-related data, group lists, user-service-related information or user location information or charging function addresses (used when the AS has not received the third-party REGISTER for a user)) between an AS (SIP AS or OSA SCS) and HSS. Also allow AS to activate/deactivate filter criteria stored in the HSS on a per-subscriber basis Diameter
Si IM-SSF, HSS Transports CAMEL subscription information, including triggers for use by CAMEL-based application services information. MAP
Sr MRFC, AS Used by MRFC to fetch documents (scripts and other resources) from an AS HTTP
Ut UE and SIP AS (SIP AS, OSA SCS, IM-SSF) PES AS and AGCF Facilitates the management of subscriber information related to services and settings HTTP(s), XCAP
z POTS, Analog phones and VoIP gateways Conversion of POTS services to SIP messages

Session handling

One of the most important features of IMS, that of allowing for a SIP application to be dynamically and differentially (based on the user's profile) triggered, is implemented as a filter-and-redirect signalling mechanism in the S-CSCF.

The S-CSCF might apply filter criteria to determine the need to forward SIP requests to AS. It is important to note that services for the originating party will be applied in the originating network, while the services for the terminating party will be applied in the terminating network, all in the respective S-CSCFs.

Initial filter criteria

An initial filter criteria (iFC) is an XML-based format used for describing control logic. iFCs represent a provisioned subscription of a user to an application. They are stored in the HSS as part of the IMS Subscription Profile and are downloaded to the S-CSCF upon user registration (for registered users) or on processing demand (for services, acting as unregistered users). iFCs are valid throughout the registration lifetime or until the User Profile is changed.[7]

The iFC is composed of:

There are two types of iFCs:

Security aspects of early IMS and non-3GPP systems

It is envisaged that security defined in TS 33.203 may not be available for a while especially because of the lack of USIM/ISIM interfaces and prevalence of devices that support IPv4. For this situation, to provide some protection against the most significant threats, 3GPP defines some security mechanisms, which are informally known as "early IMS security," in TR33.978. This mechanism relies on the authentication performed during the network attachment procedures, which binds between the user's profile and its IP address. This mechanism is also weak because the signaling is not protected on the user–network interface.

CableLabs in PacketCable 2.0, which adopted also the IMS architecture but has no USIM/ISIM capabilities in their terminals, published deltas to the 3GPP specifications where the Digest-MD5 is a valid authentication option. Later on, TISPAN also did a similar effort given their fixed networks scopes, although the procedures are different. To compensate for the lack of IPsec capabilities, TLS has been added as an option for securing the Gm interface. Later 3GPP Releases have included the Digest-MD5 method, towards a Common-IMS platform, yet in its own and again different approach. Although all 3 variants of Digest-MD5 authentication have the same functionality and are the same from the IMS terminal's perspective, the implementations on the Cx interface between the S-CSCF and the HSS are different.

See also


  1. ^ Technical Specification Group Services and System Aspects (2006), IP Multimedia Subsystem (IMS), Stage 2, TS 23.228, 3rd Generation Partnership Project
  2. ^ Alexander Harrowell, Staff Writer (October 2006), A Pointless Multimedia Subsystem?, Mobile Communications International, archived from the original on 2010-09-18
  3. ^ Zhao, Peng; Wei, Qun; Xia, Hailun; Zeng, Zhimin (2012), Tan, Honghua (ed.), "A New Mechanism of EAB in RCS", Knowledge Discovery and Data Mining, Advances in Intelligent and Soft Computing, Berlin, Heidelberg: Springer, pp. 247–254, doi:10.1007/978-3-642-27708-5_33, ISBN 978-3-642-27708-5, retrieved 2021-04-08
  4. ^ "3GPP Release Descriptions". 3GPP.
  5. ^ a b "Dispelling LTE Myths". Retrieved 2021-04-08.
  6. ^ Ian Poole, editor. "What is Voice over LTE, VoLTE".
  7. ^ a b "3GPP Stage 2 Specifications".

Further reading