IMS — IP Multimedia Subsystem Architecture Guide

In this tutorial, you'll learn about IMS. We cover key concepts, practical examples, and best practices.

IMS (IP Multimedia Subsystem) is a 3GPP standardized architecture for delivering multimedia services — voice, video, messaging — over an all-IP core network, using SIP for session control and DIAMETER for authentication and policy enforcement.

What You'll Learn

• IMS core components: P-CSCF, I-CSCF, S-CSCF, HSS, AS, MRF
• SIP registration and session setup in IMS
• How IMS enables VoLTE and VoWiFi
• Charging, policy control, and interworking with legacy networks

Why IMS Matters

IMS is the foundation for voice over 4G (VoLTE), voice over WiFi (VoWiFi), and future 5G voice (VoNR). Without IMS, operators cannot provide carrier-grade voice on all-IP networks. IMS also enables rich communications services (RCS) — the carrier messaging standard. Most importantly, IMS separates service delivery from access network — the same IMS core works over LTE, WiFi, 5G NR, or fixed broadband.

Durga Antivirus Pro uses IMS-inspired session management for its agent-server communication, with SIP-like session establishment and Diameter-style authentication for security policy enforcement.

Learning Path

flowchart LR
  A[SIP & VoIP Basics] --> B[IMS Architecture
You are here]
  B --> C[IMS Registration & Call Flow]
  B --> D[VoLTE / VoWiFi]
  C --> E[5G VoNR]
  style B fill:#f90,color:#fff

IMS Core Architecture

flowchart TD
  UE[UE / Mobile Device] --> P_CSCF[P-CSCF
Proxy CSCF]
  P_CSCF --> I_CSCF[I-CSCF
Interrogating CSCF]
  I_CSCF --> S_CSCF[S-CSCF
Serving CSCF]
  S_CSCF --> HSS[HSS
Home Subscriber Server]
  S_CSCF --> AS[AS
Application Server]
  S_CSCF --> MRF[MRF
Media Resource Function]
  P_CSCF --> PCRF[PCRF
Policy & Charging]
  PCRF --> PGW[PGW / PCEF]

IMS Registration Flow

When a device powers on and connects to LTE or WiFi, it must register with IMS before making or receiving calls:

sequenceDiagram
    UE->>P_CSCF: SIP REGISTER
    P_CSCF->>I_CSCF: SIP REGISTER (via DNS lookup)
    I_CSCF->>HSS: Diameter UAR (User-Auth-Request)
    HSS->>I_CSCF: Diameter UAA (with S-CSCF capabilities)
    I_CSCF->>S_CSCF: SIP REGISTER
    S_CSCF->>HSS: Diameter MAR (Multimedia-Auth-Request)
    HSS->>S_CSCF: Diameter MAA (auth vectors: RAND, AUTN, XRES)
    S_CSCF->>P_CSCF: SIP 401 Unauthorized (challenge)
    P_CSCF->>UE: SIP 401 Unauthorized (RAND, AUTN)
    UE->>UE: Calculate RES from AUTN and Ki
    UE->>P_CSCF: SIP REGISTER (with RES)
    P_CSCF->>I_CSCF: SIP REGISTER
    I_CSCF->>S_CSCF: SIP REGISTER (S-CSCF already known)
    S_CSCF->>HSS: Diameter SAR (Server-Assignment-Request)
    HSS->>S_CSCF: Diameter SAA (profile downloaded)
    S_CSCF->>P_CSCF: SIP 200 OK
    P_CSCF->>UE: SIP 200 OK (IMS registered)

class IMSRegistration:
    def __init__(self):
        self.state = "idle"

    def register(self, imsi, msisdn, access_type):
        print(f"[IMS] Registration started for {msisdn} (IMSI: {imsi})")
        print(f"[IMS] P-CSCF discovered via PCO from PGW")
        print(f"[IMS] SIP REGISTER sent to P-CSCF")
        print(f"[IMS] P-CSCF forwards to I-CSCF, I-CSCF queries HSS")
        auth_vector = {"RAND": "a1b2c3d4", "AUTN": "e5f6g7h8"}
        print(f"[IMS] S-CSCF challenges: 401 Unauthorized (RAND={auth_vector['RAND']})")
        print(f"[IMS] UE calculates RES from AUTN and Ki on SIM")
        res = "x9y8z7w6"
        print(f"[IMS] SIP REGISTER with credentials (RES={res})")
        if res:
            print(f"[IMS] S-CSCF validates RES == expected XRES")
            print(f"[IMS] S-CSCF downloads profile from HSS via SAR/SAA")
            self.state = "registered"
            print(f"[IMS] 200 OK -> UE registered")
            return True
        return False

ims_reg = IMSRegistration()
ims_reg.register("310410123456789", "+1-555-0142", "LTE")

Expected output:

[IMS] Registration started for +1-555-0142 (IMSI: 310410123456789)
[IMS] P-CSCF discovered via PCO from PGW
[IMS] SIP REGISTER sent to P-CSCF
[IMS] P-CSCF forwards to I-CSCF, I-CSCF queries HSS
[IMS] S-CSCF challenges: 401 Unauthorized (RAND=a1b2c3d4)
[IMS] UE calculates RES from AUTN and Ki on SIM
[IMS] SIP REGISTER with credentials (RES=x9y8z7w6)
[IMS] S-CSCF validates RES == expected XRES
[IMS] S-CSCF downloads profile from HSS via SAR/SAA
[IMS] 200 OK -> UE registered

IMS Call Flow (VoLTE)

Once registered, a VoLTE call follows this path:

UE-A -> P-CSCF -> S-CSCF (home network)
  -> I-CSCF (recipient network) -> S-CSCF -> P-CSCF -> UE-B
  SDP negotiation for AMR-WB codec
  RTP media flows directly between UEs (media path optimized)

Key Characteristics of IMS Voice

• Bearer setup: SIP signaling triggers dedicated EPS bearer via PCRF -> PGW -> SGW -> eNodeB
• Codec: AMR-WB (Adaptive Multi-Rate Wideband) at 23.85 kbps — HD voice quality
• QoS: QCI=1 (GBR, 50ms PDB) for voice bearer, QCI=5 (non-GBR) for SIP signaling
• SRVCC (Single Radio Voice Call Continuity): Handover VoLTE call to 3G/2G when LTE coverage ends

IMS Charging

IMS supports both offline and online charging:

class IMSCharging:
    def __init__(self):
        self.ctf = {"correlation_id": "", "calling": "", "called": ""}

    def start_call(self, calling, called):
        self.ctf["correlation_id"] = f"{calling}-{called}-{hash(f'{calling}{called}')%10000}"
        self.ctf["calling"] = calling
        self.ctf["called"] = called
        print(f"[CTF] ACR [Start] CC={self.ctf['correlation_id']}")

    def mid_call(self, duration_sec, rtp_packets):
        vol_up = rtp_packets * 172  # 172 bytes per RTP frame
        vol_down = rtp_packets * 172
        print(f"[CTF] ACR [Interim] Duration={duration_sec}s, Vol={vol_up+vol_down}B")

    def end_call(self, duration_sec, cause="normal"):
        print(f"[CTF] ACR [Stop] Reason={cause}, Duration={duration_sec}s")
        print(f"[OCS] Rating: ${(duration_sec/60)*0.01:.4f}")

charging = IMSCharging()
charging.start_call("+1-555-0142", "+1-555-0198")
charging.mid_call(45, 6500)
charging.end_call(120)

Expected output:

[CTF] ACR [Start] CC=+1-555-0142-+1-555-0198-3858
[CTF] ACR [Interim] Duration=45s, Vol=2236000B
[CTF] ACR [Stop] Reason=normal, Duration=120s
[OCS] Rating: $0.0200

Common Errors

1. Confusing IMS with VoLTE

VoLTE is a use case of IMS — IMS provides the SIP signaling and service platform while VoLTE is the specific voice profile. IMS also supports video calling, conferencing, messaging, and presence.

2. Ignoring SRVCC Planning

If VoLTE calls drop when moving out of LTE coverage, SRVCC handover to 3G or 2G is not configured. SRVCC requires MSC Server enhancement and Sv interface between MME and MSC.

3. Underestimating P-CSCF Discovery

The UE must discover the P-CSCF address after LTE attach. This happens via DHCP, DNS NAPTR, or PCO (Protocol Configuration Option) from the PGW. Misconfigured P-CSCF discovery means IMS registration fails.

Practice Questions

1. What are the three CSCF nodes in IMS? P-CSCF (proxy), I-CSCF (interrogating), S-CSCF (serving). Each has a distinct role in registration and routing.

2. How does IMS guarantee voice quality? Via PCRF policy enforcement: SIP signaling uses QCI=5 (non-GBR), voice bearer uses QCI=1 (GBR, guaranteed bit rate, 50ms packet delay budget).

3. What is the purpose of the HSS in IMS? Master subscriber database storing authentication vectors, service profiles, triggering information for application servers.

Challenge: Trace the complete IMS signaling for a VoLTE call between two subscribers on different operators (interconnect case). Show each SIP message, Diameter transaction, and bearer establishment with QCI values.

FAQ

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro. Updated 2026-06-24.