S6a (MME↔HSS) and S6d (SGSN↔HSS) are the Diameter interfaces, defined in 3GPP TS 29.272, that carry LTE mobility and subscription data. Key command pairs are ULR/ULA (Update-Location), AIR/AIA (Authentication-Information), CLR/CLA (Cancel-Location), PUR/PUA (Purge-UE) and IDR/IDA and DSR/DSA (Insert/Delete-Subscriber-Data).
What S6a and S6d do
When a device attaches to LTE, the MME must authenticate it, register its location with the subscriber's home HSS, and download the subscription profile that says what the subscriber is allowed to do. S6a carries this between the MME and the HSS; S6d does the same between an SGSN and the HSS for GERAN/UTRAN packet access. Both use Diameter Application-Id 16777251 (0x01000023) and Vendor-Id 10415. Functionally S6a/S6d is the LTE successor of the SS7/MAP interface between the VLR/SGSN and the HLR — the same mobility and subscription roles, re-expressed as Diameter commands and AVPs.
The S6a/S6d command set
TS 29.272 defines a compact set of command pairs on top of the Diameter base. Update-Location registers the serving MME/SGSN and pulls the subscription profile in the answer. Authentication-Information fetches EPS authentication vectors. Cancel-Location deregisters the subscriber from a previous MME. Purge-UE lets a serving node tell the HSS it has removed a detached subscriber's context. Insert- and Delete-Subscriber-Data let the HSS push or withdraw subscription changes at any time, and Reset and Notify handle HSS recovery and serving-node notifications.
| Command | Code | Purpose | MAP equivalent |
|---|---|---|---|
| ULR / ULA | 316 | Update-Location — register serving node, download profile | UpdateLocation / InsertSubscriberData |
| AIR / AIA | 318 | Authentication-Information — fetch EPS auth vectors | SendAuthenticationInfo |
| CLR / CLA | 317 | Cancel-Location — deregister from previous serving node | CancelLocation |
| PUR / PUA | 321 | Purge-UE — serving node purged the UE context | PurgeMS |
| IDR / IDA | 319 | Insert-Subscriber-Data — HSS pushes profile changes | InsertSubscriberData |
| DSR / DSA | 320 | Delete-Subscriber-Data — HSS withdraws subscription data | DeleteSubscriberData |
| NOR / NOA | 323 | Notify-Request — serving node notifies the HSS | (MAP NoteMM-Event etc.) |
| RSR / RSA | 322 | Reset — HSS signals recovery to serving nodes | MAP Reset |
Attach and Update-Location
At attach, the MME first runs Authentication-Information to get vectors and authenticate the subscriber, then sends Update-Location-Request to the HSS carrying the User-Name (IMSI), the RAT-Type, ULR-Flags and its own Origin-Host as the new MME identity. The HSS records the serving MME, issues a Cancel-Location to any previous MME, and returns Update-Location-Answer carrying the Subscription-Data Grouped AVP — APN configuration, AMBR, allowed RATs, subscribed QoS. From that point the MME has both an authenticated subscriber and a full profile, and the HSS knows where to reach them.
MME → HSS AIR { User-Name=IMSI, Visited-PLMN-Id,
Requested-EUTRAN-Auth-Info { Number-Of-Vectors } }
HSS → MME AIA { Authentication-Info { E-UTRAN-Vector
{ RAND, XRES, AUTN, KASME } } } <- EPS-AKA vector
MME → HSS ULR { User-Name=IMSI, RAT-Type=EUTRAN, ULR-Flags }
HSS → MME ULA { Subscription-Data { MSISDN, AMBR, APN-Config } }
HSS → oldMME CLR (if a previous MME was registered)EPS authentication vectors
Authentication-Information carries EPS-AKA vectors from the HSS/AuC to the MME. Each E-UTRAN vector is a Grouped AVP of four values: RAND (the random challenge), XRES (the expected response the UE must reproduce), AUTN (the network authentication token that lets the UE authenticate the network), and KASME (the local master key from which the MME derives the NAS and access-stratum keys). This is the LTE evolution of the GSM/UMTS triplet/quintet fetched over MAP SendAuthenticationInfo, extended with the KASME key hierarchy that anchors EPS security.
From MAP to Diameter
S6a/S6d deliberately mirrors the SS7/MAP operations it succeeds, which is why the two coexist in interworking networks. Update-Location replaces MAP UpdateLocation, Authentication-Information replaces SendAuthenticationInfo, Cancel-Location replaces CancelLocation, Purge-UE replaces PurgeMS, and Insert/Delete-Subscriber-Data replace their MAP namesakes. A combined HLR/HSS often serves both a MAP interface to 2G/3G nodes and an S6a interface to the LTE MME, and interworking functions translate between them so a subscriber roaming between an LTE and a legacy network keeps a consistent registration.
Frequently asked
What are S6a and S6d?
S6a is the Diameter interface between the LTE MME and the subscriber's HSS; S6d is the same between an SGSN and the HSS for packet access. Defined in 3GPP TS 29.272 (Application-Id 16777251), they carry authentication, location update and subscription management — the LTE successor to the SS7/MAP HLR interface.
What is the ULR/ULA command used for?
Update-Location-Request/Answer (command 316) registers the serving MME or SGSN with the HSS and downloads the subscription profile. The MME sends ULR at attach with the IMSI and RAT-Type; the HSS records the location, cancels any previous registration, and returns the Subscription-Data AVP in ULA.
How does the MME get authentication vectors?
With Authentication-Information-Request (AIR, command 318). The HSS/AuC returns EPS-AKA vectors in AIA — each a Grouped AVP of RAND, XRES, AUTN and KASME. The MME uses them to authenticate the subscriber and derive the NAS and access-stratum key hierarchy.
What is the MAP equivalent of S6a?
S6a maps the SS7/MAP HLR operations onto Diameter: ULR replaces UpdateLocation, AIR replaces SendAuthenticationInfo, CLR replaces CancelLocation, PUR replaces PurgeMS, and IDR/DSR replace Insert/Delete-Subscriber-Data. A combined HLR/HSS often exposes both interfaces, with interworking translating between them.
What is in an EPS authentication vector?
An E-UTRAN vector carried in AIA contains RAND (challenge), XRES (expected response), AUTN (network authentication token) and KASME (the master key the MME uses to derive NAS and AS keys). It is the LTE evolution of the UMTS quintet, extended with the KASME key hierarchy.
What Application-Id do S6a and S6d use?
Both use Diameter Application-Id 16777251 (0x01000023) with 3GPP Vendor-Id 10415. Peers advertise support for it in the CER/CEA capabilities exchange, so an MME and HSS confirm they can speak S6a before any Update-Location or Authentication-Information traffic flows.
Source specifications
The published standards this page is grounded in. Opens in a new tab.