IP Multimedia Subsystem

The IP Multimedia Subsystem, IMS, is an architectural framework, originally designed by the wireless standards body 3GPP, for delivering IP multimedia services to end users. It is a part of the vision for evolving mobile networks beyond GSM. In its original formulation (3GPP R5) it represented an approach to delivering "Internet Services" over GPRS. This vision was subsequently updated by 3GPP, 3GPP2 and TISPAN by providing requirements for support of networks other than GPRS such as Wireless LAN, CDMA2000 and Fixed line.

To ease the integration with the Internet, the IMS as far as possible utilises IETF (i.e. Internet) protocols such as SIP. According to the 3GPP , the intention of IMS is not to standardise applications within itself but rather aid the access of multimedia and voice applications across wireless and wireline terminals i.e. aid a form of Fixed Mobile Convergence (FMC). This is done by having a horizontal control layer that isolates the access network from the service layer. Each service does not have to have its own control functions as the control layer is a common horizontal layer.

There are alternative and overlapping technologies for enabling the access and provision of services across wired and wireless networks and these include, but are not limited to, depending on the actual requirements, some combination of Generic Access Network, softswitches and "naked" SIP. This is part of the reason that it is not very easy to make a business case for IMS. It is easier to sell services than it is to sell the virtues of "integrated services". But, services for IMS have not been prolific, making the IMS case harder.

The IMS was thought of and design was begun some years ago. Since then it is increasingly easier to access content or contact others using access mechanisms which are not necessarily in the control of the traditional wireless/fixed operators. In this rapidly changing commercial space traditional operators will be (re)considering their strategies. Thus, although we can still expect movement towards an all-IP future, it is less clear how much of the 3GPP/3GPP2/TISPAN IMS as exists in today's standards space will eventually be deployed.

History

• IMS was originally defined by an industry forum called 3G.IP, formed in 1999. 3G.IP developed the initial IMS architecture, which was brought to the 3rd Generation Partnership Project (3GPP), as part of their standardization work for 3G mobile phone systems in UMTS networks. It first appeared in release 5 (evolution from 2G to 3G networks), when SIP-based multimedia was added. Support for the older GSM and GPRS networks was also provided.
• Early IMS was defined to allow for IMS implementations that do not yet support all "Full IMS" requirements.
• 3GPP2 (a different organization) based their CDMA2000 Multimedia Domain (MMD) on 3GPP IMS, adding support for CDMA2000.
• 3GPP release 6 added interworking with WLAN.
• 3GPP release 7 added support for fixed networks, by working together with TISPAN release R1.

Architecture

The IP Multimedia Core Network Subsystem is a collection of different functions, linked by standardized interfaces, which grouped form one IMS administrative network. A function is not a node (hardware box) : an implementer is free to combine 2 functions in 1 node, or to split a single function into 2 or more nodes. Each node can also be present multiple times in a single network, for load balancing or organizational issues.

Access Network

The user can connect to an IMS network using various methods, all of which are using the standard Internet Protocol (IP). Direct IMS terminals (mobile phones, PDAs, computers, ...), can register directly into an IMS network, even when they're roaming in another network or country (the visited network). The only requirement is that they can use IPv6 (also IPv4 in 'Early IMS') and are running SIP User Agents. Fixed access (e.g., DSL, cable modems, Ethernet, ...), mobile access (W-CDMA, CDMA2000, GSM, GPRS, ...) and wireless access (WLAN, WiMAX, ...) are all supported. Other phone systems like the POTS (the old analogue telephones), H.323 and non IMS-compatible VoIP systems are supported through gateways.

Core Network

Home Subscriber Server

The HSS (Home Subscriber Server or User Profile Server Function UPSF) is the master user database that supports the IMS network entities that are actually handling the calls/sessions. It contains the subscription-related information (user profiles), performs authentication and authorization of the user, and can provide information about the physical location of user. It's similar to the GSM HLR and AUC.

An SLF (Subscriber Location Function) is needed to map user addresses when multiple HSSs are used. Both the HSS and the SLF communicate through the DIAMETER protocol.

User identities

In normal 3GPP networks, the following identities are used;

• International Mobile Subscriber Identity (IMSI)
• Temporary Mobile Subscriber Identity (TMSI)
• International Mobile Equipment Identity (IMEI)
• Mobile Subscriber ISDN Number (MSISDN)

IMSI is a unique user identity that is stored in the SIM. To improve privacy, a TMSI is generated per geographical location. While IMSI/TMSI are used for user identification, the IMEI is a unique device identity and is phone specific. The MSISDN is the telephone number of a user.

With IMS, the following additional identities are implemented:

• IP Multimedia Private Identity (IMPI)
• IP Multimedia Public Identity (IMPU)

Both are not phone numbers or other series of digits, but URIs, that can be digits (a tel-uri, like tel:+1-555-123-4567) or alphanumeric identifiers (a sip-uri, like sip:john.doe@example.com).

The IMPI is unique to the phone, and you can have multiple IMPU per IMPI (often a tel-uri and a sip-uri). The IMPU can also be shared with another phone, so both can be reached with the same identity (for example, a single phone-number for an entire family).

The HSS user database contains, but is not limited to, the IMPU, IMPI, IMSI, and MSISDN.

Call/Session Control

Several roles of SIP servers or proxies, collectively called CSCF (Call Session Control Function), are used to process SIP signalling packets in the IMS.

• A P-CSCF (Proxy-CSCF) is a SIP proxy that is the first point of contact for the IMS terminal. It can be located either in the visited network (in full IMS networks) or in the home network (when the visited network isn't IMS compliant yet). Some networks might use a Session Border Controller for this function. The terminal will discover its P-CSCF with either DHCP, or it's assigned in the PDP Context (in GPRS).
  • it's assigned to an IMS terminal during registration, and does not change for the duration of the registration
  • it sits on the path of all signalling messages, and can inspect every message
  • it authenticates the user and establishes an IPsec security association with the IMS terminal. This prevents spoofing attacks and replay attacks and protects the privacy of the user. Other nodes trust the P-CSCF, and do not have to authenticate the user again.
  • it can also compress and decompress SIP messages using SigComp, which reduces the round-trip over slow radio links
  • it may include a PDF (Policy Decision Function), which authorizes media plane resources e.g. quality of service (QoS) over the media plane. It's used for policy control, bandwidth management, etc ... The PDF can also be a separate function.
  • it also generates charging records

• An S-CSCF (Serving-CSCF) is the central node of the signalling plane. It's a SIP server, but performs session control as well. It's always located in the home network. The S-CSCF uses DIAMETER Cx and Dx interfaces to the HSS to download and upload user profiles - it has no local storage of the user. All necessary information is loaded from the HSS.
  • it handles SIP registrations, which allows it to bind the user location (e.g. the IP address of the terminal) and the SIP address
  • it sits on the path of all signaling messages, and can inspect every message
  • it decides to which application server(s) the SIP message will be forwarded, in order to provide their services
  • it provides routing services, typically using ENUM lookups
  • it enforces the policy of the network operator
  • there can be multiple S-CSCFs in the network for load distribution and high availability reasons. It's the HSS that assigns the S-CSCF to a user, when it's queried by the I-CSCF.

• An I-CSCF (Interrogating-CSCF) is another SIP function located at the edge of an administrative domain. Its IP address is published in the DNS of the domain (using NAPTR and SRV type of DNS records), so that remote servers can find it, and use it as a forwarding point (e.g. registering) for SIP packets to this domain. The I-CSCF queries the HSS using the DIAMETER Cx interface to retrieve the user location (Dx interface is used from I-CSCF to SLF to locate the needed HSS only), and then routes the SIP request to its assigned S-CSCF. Up to Release 6 it can also be used to hide the internal network from the outside world (encrypting part of the SIP message), in which case it's called a THIG (Topology Hiding Inter-network Gateway). From Release 7 onwards this "entry point" function is removed from the I-CSCF and is now part of the IBCF (Interconnection Border Control Function). The IBCF is used as gateway to external networks, and provides NAT and Firewall functions (pinholing).

Application Servers

Application servers (AS) host and execute services, and interface with the S-CSCF using SIP. An example of an Application Server that is being developed in 3GPP is the Voice Call Continuity Function (VCC Server). Depending on the actual service, the AS can operate in SIP proxy mode, SIP US (user agent) mode or SIP B2BUA (back-to-back user agent) mode. An AS can be located in the home network or in an external third-party network. If located in the home network, it can query the HSS with the DIAMETER Sh interface (for a SIP-AS) or the MAP interface (for IM-SSF).

• SIP AS : native IMS application server
• IM-SSF : an IP Multimedia Service Switching Function interfaces with CAMEL Application Servers using CAP

Media Servers

An MRF (Media Resource Function) provides a source of media in the home network. It's used for :

• Playing of announcements (audio/video)
• Multimedia conferencing (e.g. mixing of audio streams)
• Text-to-speech conversion (TTS) and speech recognition.
• Realtime transcoding of multimedia data (i.e. conversion between different codecs)

Each MRF is further divided into :

• An MRFC (Media Resource Function Controller) is a signalling plane node that acts as a SIP User Agent to the S-CSCF, and which controls the MRFP with a H.248 interface
• An MRFP (Media Resource Function Processor) is a media plane node that implements all media-related functions.

Breakout Gateway

A BGCF (Breakout Gateway Control Function) is a SIP server that includes routing functionality based on telephone numbers. It is only used when calling from the IMS to a phone in a circuit switched network, such as the PSTN or the PLMN.

193.113.57.167 22:37, 15 May 2007 (UTC)====PSTN Gateways==== A PSTN/CS gateway interfaces with PSTN circuit switched (CS) networks. For signalling, CS networks use ISUP (or BICC) over MTP, while IMS uses SIP over IP. For media, CS networks use PCM, while IMS uses RTP.

• An SGW (Signalling Gateway) interfaces with the signalling plane of the CS. It transforms lower layer protocols as SCTP (which is an IP protocol) into MTP (which is an SS7 protocol), to pass ISUP from the MGCF to the CS network.
• An MGCF (Media Gateway Controller Function) does call control protocol conversion between SIP and ISUP and interfaces with the SGW over SCTP. It also controls the resources in an MGW with an H.248 interface.
• An MGW (Media Gateway) interfaces with the media plane of the CS network, by converting between RTP and PCM. It can also transcode when the codecs don't match (e.g. IMS might use AMR, PSTN might use G.711).

Media Resources

Border GateWay (BGW)

• A BGW (Border GateWay) interfaces with the media plane of another NGN - eg another SP (Service Provider) who has similarly migrated to IMS - and provides a media proxy of the RTP packets. It can also transcode when the codecs and/or packetisation period don't match (e.g. SPa uses G.729 30ms and SPb uses G.711 20ms).

Charging

Offline charging is applied to users who pay for their services periodically (e.g., at the end of the month). Online charging, also known as credit-based charging, is used for prepaid services, or real-time credit control of postpaid services. Both may be applied to the same session.

• Offline Charging : All the SIP network entities (P-CSCF, I-CSCF, S-CSCF, BGCF, MRFC, MGCF, AS) involved in the session use the DIAMETER Rf interface to send accounting information to a CCF (Charging Collector Function) located in the same domain. The CCF will collect all this information, and build a CDR (Call Detail Record), which is sent to the billing system (BS) of the domain.
  Each session carries an ICID (IMS Charging Identifier) as a unique identifier. IOI (Inter Operator Identifier) parameters define the originating and terminating networks.
  Each domain has its own charging network. Billing systems in different domains will also exchange information, so that roaming charges can be applied.

• Online charging : The S-CSCF talks to an SCF (Session Charging Function) which looks like a regular SIP application server. The SCF can signal the S-CSCF to terminate the session when the user runs out of credits during a session. The AS and MRFC use the DIAMETER Ro interface towards an ECF (Event Charging Function).
  • When IEC (Immediate Event Charging) is used, a number of credit units is immediately deducted from the user's account by the ECF and the MRFC or AS is then authorized to provide the service. The service is not authorized when not enough credit units are available.
  • When ECUR (Event Charging with Unit Reservation) is used, the ECF first reserves a number of credit units in the user's account and then authorizes the MRFC or the AS. After the service is over, the number of spent credit units is reported and deducted from the account; the reserved credit units are then cleared.

Interfaces description

Interface Name	IMS entities	Description	Protocol
Cr	MRFC, AS	Used by MRFC to fetch documents (scripts and other resources) from an AS	HTTP over dedicated TCP/SCTP channels
Cx	I-CSCF, S-CSCF, HSS	Used to communicate between I-CSCF/S-CSCF and HSS	DIAMETER
Dh	SIP AS, OSA, SCF, IM-SSF, HSS	Used by AS to find a correct HSS in a multi-HSS environment	DIAMETER
Dx	I-CSCF, S-CSCF, SLF	Used by I-CSCF/S-CSCF to find a correct HSS in a multi-HSS environment	DIAMETER
Gm	UE, P-CSCF	Used to exchange messages between UE and CSCFs	SIP
Go	PDF, GGSN	Allows operators to control QoS in a user plane and exchange charging correlation information between IMS and GPRS network	COPS (Rel5), DIAMETER (Rel6+)
Gq	P-CSCF, PDF	Used to exchange policy decisions-related information between P-CSCF and PDF	DIAMETER
ISC	S-CSCF, I-CSCF, AS	Used to exchange messages between CSCF and AS	SIP
Mg	MGCF -> I-CSCF	MGCF converts ISUP signalling to SIP signalling and forwards SIP signalling to I-CSCF	SIP
Mi	S-CSCF -> BGCF	Used to exchange messages between S-CSCF and BGCF	SIP
Mj	BGCF -> MGCF	Used to exchange messages between BGCF and MGCF in the same IMS network	SIP
Mk	BGCF -> BGCF	Used to exchange messages between BGCFs in different IMS networks	SIP
Mm	I-CSCF, S-CSCF, external IP network	Used for exchanging messages between IMS and external IP networks	Not specified
Mn	MGCF, IM-MGW	Allows control of user-plane resources	H.248
Mp	MRFC, MRFP	Used to exchange messages between MRFC and MRFP	H.248
Mr	S-CSCF, MRFC	Used to exchange messages between S-CSCF and MRFC	SIP
Mw	P-CSCF, I-CSCF, S-CSCF	Used to exchange messages between CSCFs	SIP
Sh	SIP AS, OSA SCS, HSS	Used to exchange information between SIP AS/OSA SCS and HSS	DIAMETER
Si	IM-SSF, HSS	Used to exchange information between IM-SSF and HSS	MAP
Sr	MRFC, AS	Used by MRFC to fetch documents (scripts and other resources) from an AS	HTTP
Ut	UE, AS (SIP AS, OSA SCS, IM-SSF)	Enables UE to manage information related to his services	HTTP(s)

Security for "early IMS" implementations

It is envisaged that security defined in TS 33.203 may not be available for a while especially because of the lack of USIM/ISIM interfaces and prevalence of devices that support IPv4. For this situation, to provide some protection against the most significant threats, 3GPP defines some security mechanisms, which are informally known as "early IMS security", in TR33.978.

Specifications

3GPP Specs

They can be downloaded from http://www.3gpp.org/specs/numbering.htm . The list below is a small selection.

• TR 21.905 Vocabulary for 3GPP Specifications
• TS 22.066 Support of Mobile Number Portability (MNP); Stage 1
• TS 22.101 Service Aspects; Service Principles
• TS 22.141 Presence Service; Stage 1
• TS 22.228 Service requirements for the IP multimedia core network subsystem; Stage 1
• TS 22.250 IMS Group Management; Stage 1
• TS 22.340 IMS Messaging; Stage 1
• TR 22.800 IMS Subscription and access scenarios
• TS 23.002 Network Architecture
• TS 23.003 Numbering, Addressing and Identification
• TS 23.008 Organisation of Subscriber Data
• TS 23.107 Quality of Service (QoS) principles
• TS 23.125 Overall high level functionality and architecture impacts of flow based charging; Stage 2
• TS 23.141 Presence Service; Architecture and functional description; Stage 2
• TS 23.167 IMS emergency sessions
• TS 23.207 End-to-end QoS concept and architecture
• TS 23.218 IMS session handling; IM call model; Stage 2
• TS 23.221 Architectural Requirements
• TS 23.228 IMS stage 2
• TS 23.234 WLAN interworking
• TS 23.271 Location Services (LCS); Functional description; Stage 2
• TS 23.278 Customized Applications for Mobile network Enhanced Logic (CAMEL) - IMS interworking; Stage 2
• TR 23.864 Commonality and interoperability between IMS core networks
• TR 23.867 IMS emergency sessions
• TR 23.917 Dynamic policy control enhancements for end-to-end QoS, Feasibility study
• TR 23.979 3GPP enablers for Push-to-Talk over Cellular (PoC) services; Stage 2
• TR 23.981 Interworking aspects and migration scenarios for IPv4-based IMS implementations (early IMS)
• TS 24.141 Presence Service using the IMS Core Network subsystem; Stage 3
• TS 24.147 Conferencing using the IMS Core Network subsystem
• TS 24.228 Signalling flows for the IMS call control based on SIP and SDP; Stage 3
• TS 24.229 IMS call control protocol based on SIP and SDP; Stage 3
• TS 24.247 Messaging using the IMS Core Network subsystem; Stage 3
• TS 26.235 Packet switched conversational multimedia applications; Default codecs
• TS 26.236 Packet switched conversational multimedia applications; Transport protocols
• TS 29.162 Interworking between the IMS and IP networks
• TS 29.163 Interworking between the IMS and Circuit Switched (CS) networks
• TS 29.198 Open Service Architecture (OSA)
• TS 29.207 Policy control over Go interface
• TS 29.208 End-to-end QoS signalling flows
• TS 29.209 Policy control over Gq interface
• TS 29.228 IMS Cx and Dx interfaces : signalling flows and message contents
• TS 29.229 IMS Cx and Dx interfaces based on the Diameter protocol; Protocol details
• TS 29.278 CAMEL Application Part (CAP) specification for IMS
• TS 29.328 IMS Sh interface : signalling flows and message content
• TS 29.329 IMS Sh interface based on the Diameter protocol; Protocol details
• TR 29.962 Signalling interworking between the 3GPP SIP profile and non-3GPP SIP usage
• TS 31.103 Characteristics of the IMS Identity Module (ISIM) application
• TS 32.240 Telecommunication management; Charging management; Charging architecture and Principles
• TS 32.260 Telecommunication management; Charging management; IMS charging
• TS 32.299 Telecommunication management; Charging management; Diameter charging applications
• TS 32.421 Telecommunication management; Subscriber and equipment trace: Trace concepts and requirements
• TS 33.102 3G security; Security architecture
• TS 33.108 3G security; Handover interface for Lawful Interception (LI)
• TS 33.141 Presence service; security
• TS 33.203 3G security; Access security for IP-based services
• TS 33.210 3G security; Network Domain Security (NDS); IP network layer security
• TR 33.978 Security aspects of early IP Multimedia Subsystem (IMS)

IETF Specs

• RFC 2327 Session Description Protocol (SDP)
• RFC 2748 Common Open Policy Server protocol (COPS)
• RFC 2782 a DNS RR for specifying the location of services (SRV)
• RFC 2806 URLs for telephone calls (TEL)
• RFC 2915 the naming authority pointer DNS resource record (NAPTR)
• RFC 2916 E.164 number and DNS
• RFC 3087 Control of Service Context using SIP Request-URI
• RFC 3261 Session Initiation Protocol (SIP)
• RFC 3262 reliability of provisional responses (PRACK)
• RFC 3263 locating SIP servers
• RFC 3264 an offer/answer model with the Session Description Protocol
• RFC 3265 SIP-Specific Event Notification
• RFC 3310 HTTP Digest Authentication using Authentication and Key Agreement (AKA)
• RFC 3311 update method
• RFC 3312 integration of resource management and SIP
• RFC 3319 DHCPv6 options for SIP servers
• RFC 3320 signalling compression (SigComp)
• RFC 3323 a privacy mechanism for SIP
• RFC 3324 short term requirements for network asserted identity
• RFC 3325 private extensions to SIP for asserted identity within trusted networks
• RFC 3326 the reason header field
• RFC 3327 extension header field for registering non-adjacent contacts (path header)
• RFC 3329 security mechanism agreement
• RFC 3420 Internet Media Type message/sipfrag
• RFC 3428 SIP Extension for Instant Messaging
• RFC 3455 private header extensions to SIP for 3GPP
• RFC 3485 SIP and SDP static dictionary for signaling compression
• RFC 3515 the SIP REFER method
• RFC 3550 Real-time Transport Protocol (RTP)
• RFC 3574 Transition Scenarios for 3GPP Networks
• RFC 3588 DIAMETER base protocol
• RFC 3589 DIAMETER command codes for 3GPP release 5 (informational)
• RFC 3608 extension header field for service route discovery during registration
• RFC 3665 SIP Basic Call Flow Examples
• RFC 3680 SIP event package for registrations
• RFC 3725 best current practices for Third Party Call Control (3pcc) in SIP
• RFC 3824 using E164 numbers with SIP
• RFC 3840 indicating user Agent Capabilities in SIP
• RFC 3841 caller preferences for SIP
• RFC 3842 SIP event package for message waiting indication and summary
• RFC 3856 SIP event package for presence
• RFC 3857 SIP event template-package for watcher info
• RFC 3858 XML based format for watcher information
• RFC 3891 the SIP Replaces Header
• RFC 3903 SIP Extension for Event State Publication
• RFC 3911 the SIP Join Header
• RFC 4028 session timers in SIP
• RFC 4235 an INVITE-Initiated dialog event package for SIP
• RFC 4475 Session Initiation Protocol (SIP) Torture Test Messages

See also

• Next Generation Networking (NGN), 4G
• Softswitch
• Triple play
• Voice over IP
• SIP
• ENUM
• SIMPLE
• ISIM, USIM
• 3GPP Long Term Evolution, WiMAX, UMB (4G network efforts that will use technologies like IMS)
• Mobile Broadband

External links

• http://www.3gpp.org 3GPP home page
• http://www.3gpp.org/specs/numbering.htm 3GPP specifications
• http://www.sipknowledge.com/SIP_RFC.htm ; IETF specifications (sorted by WG/areas)
• http://www.bcr.com/bcrmag/2005/06/p18.php Article - IMS 101: What You Need To Know Now
• http://www.tech-invite.com/ SIP/IMS Technical Portal
• http://www.rennes.enst-bretagne.fr/~gbertran/files/IMS_an_overview.pdf - A decent IMS tutorial

Books

• "The 3G IP Multimedia Subsystem (IMS): Merging the Internet and the Cellular Worlds" by Gonzalo Camarillo, Miguel-Angel García-Martín (John Wiley & Sons, 2006, ISBN 0-470-01818-6)
• "The IMS: IP Multimedia Concepts and Services" by Miikka Poikselka, Aki Niemi, Hisham Khartabil, Georg Mayer (John Wiley & Sons, 2006, ISBN 0-470-01906-9)