Diameter Signaling Fundamentals

Diameter is the authentication, authorization, and accounting (AAA) signalling protocol that 4G/LTE and IMS networks use where earlier networks used SS7/MAP. Defined by the IETF in RFC 6733 (which obsoleted the original RFC 3588), it is the evolved successor to RADIUS — the name is an engineering pun, twice the RADIUS.

Unlike SS7, Diameter is an IP-native, peer-to-peer protocol that runs over a reliable transport (TCP or SCTP) and mandates transport-level security (TLS or IPsec). Every node is a Diameter peer identified by a Diameter Identity and grouped into a realm, and peers discover and connect to each other rather than routing over fixed point codes.

Messages come in request/answer pairs distinguished by an application. The base protocol handles the machinery — capability exchange (CER/CEA), keepalives (DWR/DWA), and disconnect (DPR/DPA) — while each 3GPP interface (S6a, Gx, Gy, Cx) is a Diameter application layered on top. Understanding the base is the prerequisite for every interface that follows.

A Diameter message is a header plus a list of Attribute-Value Pairs (AVPs). The AVP is the fundamental unit of data: each carries an AVP code, flags (including the mandatory 'M' bit), a length, and a value, and AVPs can be grouped to nest structured data. Vendor-specific AVPs (3GPP is vendor 10415) extend the standard set for mobile use.

The header carries a Command Code that names the operation and an Application-Id that scopes it. A request and its answer share the same command code and hop-by-hop and end-to-end identifiers, which is how a node correlates an answer to the request it sent and detects duplicates.

Result-Code AVPs report outcome in classes mirroring HTTP intent — 2xxx success, 3xxx protocol errors, 4xxx transient failures, 5xxx permanent failures — so an integrator reads the class first, then the specific code. Getting the mandatory AVPs and their exact grouping right is the difference between an interface that interworks and one an operator's peer silently rejects.

S6a is the Diameter interface between the MME (Mobility Management Entity) and the HSS (Home Subscriber Server) in an LTE core; S6d is the equivalent toward the SGSN. It is the LTE analogue of the SS7/MAP interface to the HLR, and the HSS is the evolved, IMS-aware successor to the HLR.

The core exchanges are subscriber authentication and location management. The MME requests authentication vectors with Authentication-Information-Request/Answer (AIR/AIA), registers the subscriber's location with Update-Location-Request/Answer (ULR/ULA) and receives the subscription profile, and the HSS can push changes or force a detach with Insert- and Cancel-Location messages. These are specified in 3GPP TS 29.272.

Because S6a carries authentication material and subscriber identity, it is a high-value target at network borders — the Diameter counterpart to the SS7 abuses that drove signalling firewalls. That is why roaming Diameter traffic is filtered and screened at the edge, covered in the roaming-security lesson.

Policy and charging control (PCC) is where Diameter shapes what a subscriber's session is allowed to do. The Gx interface connects the PCEF (Policy and Charging Enforcement Function, in the PDN gateway) to the PCRF (Policy and Charging Rules Function), which installs PCC rules governing bandwidth (QoS), gating, and per-application treatment via Credit-Control-Request/Answer (CCR/CCA) exchanges.

Gy is the online-charging interface between the PCEF and the OCS (Online Charging System). It uses the Diameter Credit-Control Application (RFC 4006) to reserve, grant, and debit quota in real time — the mechanism behind prepaid data, where a session is cut off or throttled the moment its allowance is exhausted.

Offline charging uses the Rf interface toward the CGF/CDF, producing charging records for post-processing rather than real-time control. The distinction — Gy reserves credit before the fact, Rf records usage after it — is the practical dividing line between prepaid and postpaid handling.

In IMS, Diameter's Cx interface connects the I-CSCF and S-CSCF call-session control functions to the HSS, handling user registration, authentication (multimedia auth via MAR/MAA), and server assignment (SAR/SAA). This is what lets IMS authenticate a subscriber and locate the serving node for VoLTE and other IMS services, complementing the SIP signalling that controls the session itself.

At the network edge, the Diameter Routing Agent (DRA) provides central routing so nodes need not maintain a full peer mesh, and the Diameter Edge Agent (DEA) is the border element that terminates and screens inbound roaming Diameter traffic. The DEA is where topology hiding, rate limiting, and message screening are enforced.

The security concern mirrors SS7: the original trust-every-peer assumption fails on an open interconnect, so GSMA guidance (the FS.19 Diameter interconnect security profile) defines category-based filtering — which messages may legitimately arrive from a roaming partner versus only from inside the home network. A Diameter edge that skips this screening is exposed to the same location-tracking and interception abuses that signalling firewalls were built to stop.