A Diameter Routing Agent (DRA) routes Diameter by realm inside a network and binds sessions to the right PCRF/HSS; a Diameter Edge Agent (DEA) sits at the IPX roaming border. Like SS7, Diameter lacks message-level authentication, so the DEA enforces GSMA FS.19 controls — topology hiding, AVP filtering and rate-limiting — against info disclosure, location tracking and fraud.
Realm-based routing and the DRA
Diameter routes on realms, not fixed hosts. A node forwarding a request consults the Destination-Realm AVP (and optionally Destination-Host) and passes the message toward the peer that serves that realm, using a realm routing table. In a large network the Diameter Routing Agent (DRA, TS 29.213) centralises this: it aggregates the mesh of MMEs, PCEFs, HSSs and PCRFs so each node peers with the DRA rather than with everyone, and — importantly for policy — it binds all the Diameter sessions of one subscriber to the same PCRF, so Gx, Rx and Sd decisions for that user stay consistent. The DRA is the internal traffic director of the Diameter core.
The Diameter Edge Agent at the roaming border
Roaming means Diameter must cross between operators, and it does so over the IPX rather than the public internet. The Diameter Edge Agent (DEA) is the single controlled gateway a network exposes at that border. All inbound and outbound roaming Diameter — S6a for LTE roaming (GSMA IR.88), Cx/Sh-adjacent IMS roaming (IR.65), S9 for policy roaming — transits the DEA. Concentrating interconnect at one hardened node is what makes security enforceable: the operator has exactly one place to authenticate peers, hide its internal topology, and screen every AVP. It is the Diameter analogue of the SS7 signalling firewall at the SS7 border.
| Agent | Where | Role |
|---|---|---|
| DRA | Inside the operator core | Realm routing + bind subscriber sessions to one PCRF/HSS |
| DEA | At the IPX / roaming border | Single controlled interconnect gateway; security enforcement |
| Relay agent | Core | Route on realm without altering AVPs |
| Proxy agent | Core / border | Route and may modify AVPs (policy enforcement) |
Why Diameter interconnect is exploitable
Diameter was, like SS7, designed for a trusted club of operators, and it carries no cryptographic authentication of message origin at the application layer — a peer trusts a Destination-Realm and an Origin-Host it cannot verify. The IPX is more contained than the open SS7 interconnect became, but the same structural weakness applies: a party with Diameter reach into the interconnect can send S6a or Cx-style requests that a network may answer as though they came from a legitimate roaming partner. As LTE and VoLTE carried more traffic, researchers and GSMA showed the SS7 attack playbook — location tracking, subscriber-data disclosure, fraud, denial of service — reappearing over Diameter.
The FS.19 threat classes
GSMA FS.19 (Diameter Interconnect Security) is the Diameter counterpart to the SS7 FS.11 guidance. It categorises the risks on interconnect Diameter and defines the messages and AVPs an edge agent should screen. The core threats mirror SS7: disclosure of subscriber and network information (harvesting IMSIs, serving-node identities and subscription data), location tracking (deriving a subscriber's location from mobility and routing messages), interception and fraud (manipulating registration or charging), and denial of service (deregistering or de-provisioning subscribers). FS.19 pairs each with recommended filtering at the DEA.
| Threat | Example over Diameter | DEA control |
|---|---|---|
| Information disclosure | Unsolicited S6a queries harvesting IMSI / serving MME | Origin verification + message-type filtering |
| Location tracking | Mobility/routing requests revealing subscriber location | Category filtering + plausibility checks |
| Interception / fraud | Spoofed location or charging updates | Session binding, state consistency checks |
| Denial of service | Forged Cancel-Location / de-registration | Origin-realm validation, rate-limiting |
| Topology exposure | Origin-Host / Route-Record leaking internal FQDNs | Topology hiding at the DEA |
Controls: topology hiding, AVP filtering, rate-limiting
A Diameter Edge Agent enforces FS.19 in layers, much as an SS7 firewall enforces FS.11. Topology hiding rewrites or strips the Origin-Host, Route-Record and other AVPs that would otherwise leak the internal FQDNs and addresses of the MMEs, HSSs and PCRFs behind the border, presenting only the edge identity outward. AVP filtering validates that each inbound message carries only the AVPs its command legitimately needs, and that values such as the Visited-PLMN-Id and Origin-Realm are consistent with the peer that sent them — dropping messages whose claimed origin does not match the roaming agreement. Rate-limiting and velocity checks catch harvesting and implausible mobility, and everything is logged for anomaly detection.
on inbound Diameter message from IPX peer P (realm R):
if Origin-Realm(msg) != R: drop + alert # spoofed origin
if command not in ROAMING_ALLOWED(R): drop + alert # not per agreement
if AVP set contains disallowed/mandatory-unknown AVPs: drop + alert
if velocityImplausible(subscriber, Visited-PLMN-Id): drop + alert
strip/rewrite Origin-Host, Route-Record # topology hiding
rate-limit per peer; else: forward via DRA + logOne firewall for SS7, SIGTRAN and Diameter
Networks rarely run only Diameter — they interwork with 2G/3G over SS7/MAP and transport SS7 over IP with SIGTRAN, so a subscriber's mobility can be attacked on whichever plane is weakest. FS.11 (SS7) and FS.19 (Diameter) are deliberately aligned so that a signalling security function can apply consistent policy across both: correlate a location-tracking attempt whether it arrives as a MAP AnyTimeInterrogation or a Diameter mobility query, and hide topology on every interconnect. Treating SS7, SIGTRAN and Diameter as one signalling attack surface — rather than three separate firewalls — is the practical stance for an operator carrying legacy and LTE/VoLTE roaming side by side.
Frequently asked
What is a Diameter Routing Agent (DRA)?
A DRA is a node that routes Diameter on the Destination-Realm inside an operator's core, so each MME, PCEF, HSS and PCRF peers with the DRA rather than with everyone. It also binds all of a subscriber's Diameter sessions to the same PCRF/HSS, keeping policy and subscription decisions consistent across Gx, Rx and Sd.
What is a Diameter Edge Agent (DEA)?
A DEA is the single controlled Diameter gateway a network exposes at the IPX roaming border. All inbound and outbound roaming Diameter — S6a, IMS and policy interfaces — transits it, so the operator has one place to authenticate peers, hide internal topology and filter AVPs. It is the Diameter equivalent of the SS7 signalling firewall.
Is Diameter more secure than SS7?
Not fundamentally. Diameter roams over the more contained IPX rather than open SS7 interconnect, but it still lacks application-layer authentication of message origin, so the SS7 attack classes — location tracking, subscriber-data disclosure, fraud, denial of service — reappear over Diameter. GSMA FS.19 exists precisely because the risks carry over.
What is GSMA FS.19?
FS.19 is the GSMA Diameter Interconnect Security guidance, the Diameter counterpart to FS.11 for SS7. It categorises interconnect threats — information disclosure, location tracking, interception/fraud, denial of service — and defines the messages and AVPs a Diameter Edge Agent should screen, together with topology hiding and rate-limiting.
What is topology hiding in Diameter?
Topology hiding is a DEA control that rewrites or strips AVPs such as Origin-Host and Route-Record, which would otherwise leak the internal FQDNs and addresses of the MMEs, HSSs and PCRFs behind the border. Only the edge identity is presented outward, so a roaming partner cannot map the internal network.
How does realm-based routing work in Diameter?
A Diameter node reads the Destination-Realm AVP (and optionally Destination-Host) and forwards the request toward the peer that serves that realm, using a realm routing table and, optionally, DNS-based peer discovery. Realm routing is what lets a visited network reach a home HSS during roaming without pre-configuring its address.
Source specifications
The published standards this page is grounded in. Opens in a new tab.