Cx/Dx are the Diameter interfaces between the IMS CSCFs and the HSS, defined in 3GPP TS 29.228/29.229. During SIP registration the I-CSCF uses UAR/UAA to find or assign an S-CSCF, the S-CSCF uses MAR/MAA to fetch authentication data and SAR/SAA to register, and LIR/LIA locates the serving S-CSCF for a terminating call. The Sh interface links application servers to the HSS.
Where Cx/Dx sit in IMS
In the IP Multimedia Subsystem, SIP call control runs across three CSCF roles — the Proxy-CSCF at the edge, the Interrogating-CSCF at the network border, and the Serving-CSCF that holds the registration and runs service logic. The HSS holds each user's IMS subscription and authentication data. Cx is the Diameter interface between the I-CSCF/S-CSCF and the HSS; Dx is the same interface routed via an SLF (Subscription Locator Function) when several HSSs are deployed and the CSCF must first find which one holds the user. Both use Application-Id 16777216 (0x01000000) and Vendor-Id 10415. Every SIP REGISTER and terminating INVITE triggers Cx transactions behind the scenes.
The Cx command set
TS 29.229 defines four Cx command pairs plus two HSS-initiated ones. User-Authorization (UAR/UAA) lets the I-CSCF check whether a user may register from a given network and learn the assigned or capable S-CSCF. Multimedia-Auth (MAR/MAA) lets the S-CSCF fetch authentication vectors (IMS-AKA or SIP Digest) from the HSS. Server-Assignment (SAR/SAA) registers or deregisters the S-CSCF for the user and downloads the user profile with its initial Filter Criteria. Location-Info (LIR/LIA) lets the I-CSCF find the serving S-CSCF for a terminating request. Registration-Termination (RTR/RTA) and Push-Profile (PPR/PPA) let the HSS deregister a user or push a profile change.
| Command | Code | Purpose |
|---|---|---|
| UAR / UAA | 300 | User-Authorization — check registration, find/assign S-CSCF |
| SAR / SAA | 301 | Server-Assignment — register S-CSCF, download user profile |
| LIR / LIA | 302 | Location-Info — find the serving S-CSCF for a terminating call |
| MAR / MAA | 303 | Multimedia-Auth — fetch IMS-AKA / SIP-Digest auth data |
| RTR / RTA | 304 | Registration-Termination — HSS deregisters the user |
| PPR / PPA | 305 | Push-Profile — HSS pushes a subscription/profile change |
How Cx ties to SIP REGISTER
IMS registration is a SIP procedure with a Diameter backend. When a user sends SIP REGISTER, the P-CSCF forwards it to the I-CSCF, which sends a Cx UAR to the HSS to authorize the registration and get an S-CSCF (or its capabilities). The I-CSCF routes the REGISTER to the chosen S-CSCF, which sends a Cx MAR to fetch an authentication challenge, and returns a SIP 401 with the IMS-AKA challenge. The UE re-registers with its response; the S-CSCF verifies it and sends a Cx SAR to register itself for the user and download the profile. So one visible SIP registration drives UAR, MAR and SAR underneath.
UE → P-CSCF → I-CSCF SIP REGISTER
I-CSCF → HSS Cx UAR { Public-Identity, Visited-Network }
HSS → I-CSCF Cx UAA { Server-Name / S-CSCF capabilities }
I-CSCF → S-CSCF SIP REGISTER
S-CSCF → HSS Cx MAR { SIP-Auth-Data-Item (IMS-AKA) }
S-CSCF → UE SIP 401 (challenge) ... UE re-REGISTERs
S-CSCF → HSS Cx SAR { Server-Assignment-Type=REGISTRATION }
HSS → S-CSCF Cx SAA { User-Data: profile + iFC }Terminating calls and LIR
Registration stores which S-CSCF serves a user; a terminating call has to find it again. When an INVITE arrives for a subscriber, the I-CSCF sends a Cx Location-Info-Request to the HSS, which returns the Server-Name of the S-CSCF currently serving that public identity. The I-CSCF then routes the INVITE to that S-CSCF, which applies the terminating service logic (its initial Filter Criteria) and forwards toward the user. LIR/LIA is thus the terminating-side counterpart of the UAR/SAR pair used at registration.
The Sh interface: application servers and the HSS
IMS application servers need subscriber data too — service settings, presence, repository data — and they get it over the Sh interface (TS 29.328/29.329, Application-Id 16777217), not Cx. Sh defines User-Data (UDR/UDA) to read transparent and service data, Profile-Update (PUR/PUA) to write it back, and a subscribe/notify pair — Subscribe-Notifications (SNR/SNA) and Push-Notification (PNR/PNA) — so an AS is told when data it cares about changes. This keeps service logic in the application servers while the HSS remains the single source of subscriber truth, and it is why the HSS, not the CSCF, is the anchor of the IMS control plane.
| Command | Code | Purpose |
|---|---|---|
| UDR / UDA | 306 | User-Data — AS reads subscriber/service data from the HSS |
| PUR / PUA | 307 | Profile-Update — AS writes repository/service data |
| SNR / SNA | 308 | Subscribe-Notifications — AS subscribes to data changes |
| PNR / PNA | 309 | Push-Notification — HSS notifies the AS of a change |
Frequently asked
What are the Cx and Dx interfaces?
Cx is the Diameter interface between the IMS I-CSCF/S-CSCF and the HSS (TS 29.228/29.229, Application-Id 16777216), carrying registration, authentication and profile download. Dx is the same interface routed via an SLF when multiple HSSs are deployed, so the CSCF first finds which HSS holds the user.
How does IMS registration use Diameter?
A SIP REGISTER triggers Cx transactions: the I-CSCF sends UAR to authorize and find an S-CSCF, the S-CSCF sends MAR to fetch an IMS-AKA challenge, and after the UE answers the challenge the S-CSCF sends SAR to register itself and download the user profile. One SIP registration drives UAR, MAR and SAR underneath.
What is the difference between MAR and SAR?
Multimedia-Auth-Request (MAR, command 303) fetches authentication data — an IMS-AKA vector or SIP Digest — so the S-CSCF can challenge the user. Server-Assignment-Request (SAR, command 301) registers the S-CSCF as the serving node for the user and downloads the user profile with its initial Filter Criteria.
How is a terminating IMS call routed to the right S-CSCF?
The I-CSCF sends a Cx Location-Info-Request (LIR, command 302) to the HSS, which returns the Server-Name of the S-CSCF currently serving the called public identity. The I-CSCF then routes the INVITE to that S-CSCF, which applies terminating service logic and forwards to the user.
What is the Sh interface for?
Sh (TS 29.329, Application-Id 16777217) connects IMS application servers to the HSS. An AS reads subscriber and service data with User-Data (UDR), writes it back with Profile-Update (PUR), and uses Subscribe-Notifications (SNR) / Push-Notification (PNR) to be told when data changes — keeping the HSS as the single source of subscriber truth.
Why does IMS use both SIP and Diameter?
SIP handles the session signalling between the UE and the CSCFs — REGISTER, INVITE, media negotiation. Diameter Cx/Dx and Sh handle the subscriber-data side against the HSS — authorization, authentication vectors, profile download and service data. The visible SIP flow and the hidden Diameter flow work together on every registration and call.
Source specifications
The published standards this page is grounded in. Opens in a new tab.