BlogP-CSCF, I-CSCF, S-CSCF Explained: Roles in the IMS Core

In an IMS (IP Multimedia Subsystem) network – the platform behind VoLTE, VoWiFi and VoNR – every call and message is a SIP request that travels through a group of functions called the CSCF (Call Session Control Function). The CSCF comes in three roles: P-CSCF, I-CSCF and S-CSCF. This article explains what each one does, where it sits, which interfaces it uses, and how a registration and a call move through them.

The functions are specified in 3GPP TS 23.228 (IMS architecture) and TS 24.229 (SIP/SDP call control in IMS).

What is a CSCF?

A CSCF is a purpose-built SIP proxy / registrar of the IMS. It does not carry media (voice and video travel through the access network and separate media entities); it handles SIP signaling only: subscriber authentication, registration, session routing, and invoking Application Servers (AS) for services such as the Telephony AS or SMS over IP.

The three roles are split so each does one job: a node next to the subscriber (P-CSCF), a gateway into the home network (I-CSCF), and a central service-control node (S-CSCF).

What is the P-CSCF?

The P-CSCF (Proxy-CSCF) is the user equipment’s (UE) first SIP contact point in the IMS. All SIP traffic from the UE enters through the P-CSCF, and all traffic towards the UE leaves through it.

Main duties:

• Signaling security with the UE: sets up an IPsec security association on the Gm interface using IMS AKA (3GPP TS 33.203), protecting the integrity of SIP messages between UE and network.
• Message forwarding: forwards REGISTER towards the I-CSCF/S-CSCF and routes INVITE and other requests along the path learned at registration.
• Identity handling: verifies the registered identity and inserts headers such as P-Asserted-Identity and P-Charging-Vector for charging.
• QoS control: talks to the PCRF (4G, Rx interface) or PCF (5G, N5 interface) to request a dedicated bearer for voice.
• Emergency detection: recognizes emergency sessions and hands them to the E-CSCF.

The UE usually discovers the P-CSCF from information delivered when the IMS data connection (PDN connection / PDU session) is set up, or via DHCP/DNS.

What is the I-CSCF?

The I-CSCF (Interrogating-CSCF) is the entry point of the home network for SIP requests arriving from other networks or from a visited network’s P-CSCF. Its address is typically published in DNS so other networks know where to send traffic.

Main duties:

• Ask the HSS to pick an S-CSCF: for a first-time registration the I-CSCF queries the HSS (Diameter, Cx interface, UAR/UAA) to learn which S-CSCF should serve the user; for a call to an already-registered user it queries the HSS (LIR/LIA) to find the serving S-CSCF.
• Forward the request to the selected S-CSCF.
• (Deployment-dependent) Hide the home network topology from outside networks; in later 3GPP releases this usually belongs to the IBCF.

The I-CSCF keeps no registration state and does no service control – it is a smart router driven by HSS data.

What is the S-CSCF?

The S-CSCF (Serving-CSCF) is the heart of the IMS: where the user is registered and where service decisions are made. It always sits in the user’s home network.

Main duties:

• SIP registrar: accepts REGISTER and stores the registration state and contact address of the UE.
• Authentication: fetches authentication vectors from the HSS (Cx, MAR/MAA) and challenges the UE with IMS AKA (401 Unauthorized).
• Profile download: after successful registration, downloads the user profile from the HSS (SAR/SAA), including the iFC (initial Filter Criteria).
• iFC-driven session control: decides which requests must be routed to which Application Server (ISC interface) – for example INVITE to the Telephony AS for call forwarding or barring.
• Routing: translates E.164 numbers to SIP URIs (ENUM) and forwards to other networks or to the BGCF/MGCF for PSTN/2G/3G breakout.

P-CSCF vs I-CSCF vs S-CSCF at a glance

Key interfaces

• Gm: UE ↔ P-CSCF (SIP).
• Mw: between CSCFs (SIP).
• Cx: I-CSCF/S-CSCF ↔ HSS (Diameter).
• ISC: S-CSCF ↔ Application Server (SIP).
• Rx / N5: P-CSCF ↔ PCRF (4G) / PCF (5G) for policy and QoS.

How does a REGISTER flow through the CSCFs?

1. The UE sends REGISTER to the P-CSCF.
2. The P-CSCF forwards it to the home network’s I-CSCF.
3. The I-CSCF sends a UAR to the HSS, gets what it needs to pick an S-CSCF, and forwards the REGISTER there.
4. The S-CSCF fetches authentication vectors from the HSS (MAR/MAA) and answers 401 Unauthorized with an AKA challenge.
5. The UE computes the response and sends REGISTER again with credentials.
6. The S-CSCF verifies it, sends a SAR to download the subscriber profile, and replies 200 OK.

In the reply the S-CSCF adds a Service-Route header (so the UE knows where to send later requests), and the P-CSCF is recorded through the Path header – which is why later calls always follow the chain P-CSCF → S-CSCF.

A simple call (INVITE) flow

1. The calling UE sends INVITE to the P-CSCF → the caller’s S-CSCF, which applies iFC and may involve an Application Server.
2. The S-CSCF routes to the callee’s network, where the request enters the I-CSCF.
3. The I-CSCF asks the HSS (LIR) which S-CSCF serves the callee and forwards the request there.
4. The callee’s S-CSCF applies iFC and forwards via the P-CSCF to the called UE.

CSCF in VoLTE, VoWiFi and 5G

• VoLTE / VoWiFi: the UE registers to IMS through the P-CSCF; for VoLTE, the P-CSCF also requests a dedicated voice bearer through the PCRF.
• VoNR (5G): the CSCF architecture is kept; the differences are mostly in the access and core network, where the P-CSCF works with the PCF over N5 instead of the PCRF over Rx.

Open-source software to practice with

For hands-on learning, look at the IMS modules of Kamailio (acting as P/I/S-CSCF) or open-source 5G cores such as Open5GS combined with an open-source IMS in a lab. Use an isolated test environment, separate from any commercial network.

Frequently asked questions

What is the difference between P-CSCF, I-CSCF and S-CSCF?

The P-CSCF is the UE’s first contact point and handles security and QoS; the I-CSCF is the home network’s entry point that asks the HSS to choose an S-CSCF; the S-CSCF is where registration, authentication and service control via iFC happen.

Does the CSCF handle voice (media)?

No. The CSCF handles SIP signaling only. Media flows through the access network and separate media entities.

How many S-CSCFs serve one registered user?

At any time an IMS identity is served by one S-CSCF, chosen by the HSS/I-CSCF at registration and kept until the registration expires or is removed.

What is the HSS’s role for the CSCFs?

The HSS stores subscriber data, authentication vectors and the service profile (iFC); the I-CSCF and S-CSCF query it over the Cx (Diameter) interface.

Is the CSCF still used in 5G?

Yes. IMS remains the voice platform for VoNR, so P/I/S-CSCF still exist; the difference is that policy and QoS work with the PCF over N5.