MVNO BSS/OSS Platform Architecture

Complete technical guide to designing, building, and operating a production telecom stack for MVNOs.

Full BSS/OSS Stack

HLR + EPC + IMS

DIAMETER/SS7 Ready

GSMA Compliant

Published: April 15, 2026 | By Kaushik Parmar, Founder & VoIP Architect, CelloIP Technologies

What is MVNO BSS/OSS?

BSS (Business Support Systems) handles billing, CRM, and revenue management. OSS (Operational Support Systems) manages network provisioning, inventory, and fault management. Together they form the complete telecom operating platform for an MVNO.

What does an MVNO core network include?

A full MVNO core includes HLR/HSS (subscriber database), SMSC (SMS center), USSD gateway, DIAMETER/SS7 signaling, EPC (4G) or IMS (VoLTE) stack, roaming agreements (GRX/IPX), and integration with MNO interconnect points.

BSS Architecture Deep Dive

The Business Support Systems layer manages all customer-facing and revenue-generating operations. From prepaid/postpaid billing to CRM and revenue assurance, BSS is the financial backbone of an MVNO.

Billing Engine

Prepaid/postpaid processing, threshold management, invoice generation

CRM System

Subscriber management, lifecycle automation, customer portals

Mediation Platform

CDR collection, rating, aggregation from multiple sources

Rating Engine

Real-time tariff application, discount logic, promotion rules

Revenue Assurance

Leakage detection, reconciliation, audit trails

BSS Sub-Components

Prepaid Billing

Real-time balance management, USSD checks, automatic top-up triggers, and threshold-based service suspension. Typically powered by IN (Intelligent Network) or DIAMETER interfaces.

Postpaid Billing

Invoice generation, payment settlement, late-payment dunning, and credit control. Integrates with mediation for accurate CDR rating.

Mediation Platform

Aggregates CDRs from MSC, SMSC, APN gateway, IMS, and other network elements. Applies rating rules, deduplication, and data normalization before sending to billing.

Rating Engine

Applies tariff plans, discount rules, and promotional logic in real-time. Calculates call/SMS/data charges based on subscriber profile and service plan.

Revenue Assurance

Detects leakage between network elements and billing. Reconciles settlement with MNO interconnect, audits data integrity, and flags anomalies.

OSS Architecture Deep Dive

The Operational Support Systems layer manages the network infrastructure—from service provisioning and inventory tracking to fault management and capacity planning. OSS ensures the network runs reliably and efficiently.

Network Provisioning

Service instantiation, activation workflows, auto-configuration

Inventory Management

HLR records, IMSI/IMEI tracking, SIM provisioning

Fault Management

Alarms, SLA monitoring, incident resolution

Number Portability

MNP integration, porting workflows, SPID management

Capacity Planning

Subscriber growth forecasting, resource allocation

Provisioning Workflow

  1. Customer places order through self-care portal or sales team
  2. OSS receives service request via SOAP/REST API or SFTP
  3. Provisioning engine validates subscriber, service, and SIM status
  4. HLR insertion: IMSI → IMEI mapping, service profile, APN assignment
  5. Billing system activation: rating plan, credit limit, service flags
  6. Confirmation sent to customer via email/SMS
  7. OSS continues monitoring for activation completion and alarms

HLR/HSS & Core Network Components

The HLR (Home Location Register) and HSS (Home Subscriber Server) are the authoritative subscriber databases. They store authentication credentials, service profiles, and authorization rules for every subscriber on the network.

Architecture Diagram: Core Network Flow


┌─────────────────────────────────────────────────────────────────┐
│                     MVNO CORE NETWORK                            │
└─────────────────────────────────────────────────────────────────┘

  UE (Phone)
    ↓ (DIAMETER Cx/Dx)
    │
  MME (Mobility Management)  ←→  HSS (Home Subscriber Server)
    ↓                                ↑  (Diameter Cx)
  SGW (Serving Gateway)             │
    ↓                                │
  PGW (PDN Gateway) ────────→ PCRF (Policy Control)
    ↓                                │
  [Internet / APN]            (Diameter Gx)
    ↓
  BSS (Billing)  ←──CDR────  SMSC / USSD Gateway
    ↓
  Revenue Assurance & Mediation

Key Signaling Paths:
  • Cx: Home Subscriber Server (HSS) ←→ MME/S-CSCF (DIAMETER)
  • Dx: HSS ←→ Other HSS (Inter-operator, DIAMETER)
  • Gx: PGW ←→ PCRF (Policy enforcement, DIAMETER)
  • S6a: Evolved MSC ←→ HSS (Location update, DIAMETER)
  • Sy: Policy Server ←→ PCRF (Charging/policy sync, DIAMETER)
              

2G/3G HLR (Legacy)

  • Stores IMSI, Ki (authentication key), MSISDN
  • Handles MAP (Mobile Application Part) signaling via SS7
  • Manages location area, roaming restrictions
  • Supports ODB (Operator Determined Barring) rules
  • Typical capacity: 100M–500M subscribers

4G/5G HSS

  • NoSQL database (Cassandra, MongoDB) for horizontal scaling
  • Stores UE Profile, EPS subscription, QoS parameters
  • DIAMETER Cx interface to MME/S-CSCF
  • Supports IMS, VoLTE, 5G SA (Standalone) networks
  • Real-time consistency: ~10ms query response

AuC (Authentication Center)

  • Generates authentication vectors (K, RAND, AUTN, XRES)
  • Protects against replay attacks and unauthorized access
  • Can be co-located with HLR or separate module
  • DIAMETER S6a interface to MME
  • Critical for 5G: implements MILENAGE/AKA-prime

EIR (Equipment Identity Register)

  • Tracks IMEI (handset identity) status
  • Blacklist management for lost/stolen devices
  • IMEI-IMSI binding validation
  • Fraud detection: unusual device/location combinations
  • Can be internal or shared with MNO

SMSC (Short Message Service Center)

  • Stores & forwards SMS messages
  • Handles MT (Mobile Terminated) routing
  • Can be MNO-hosted or dedicated MVNO instance
  • GTP-C interface to GGSN for delivery
  • Supports SMS-based OTPs, alerts, 2FA

USSD Gateway

  • Unstructured Supplementary Service Data: menu-driven access
  • Real-time balance checks, top-up, service activation
  • MAP SS7 interface for legacy networks
  • Diameter/REST APIs for modern deployments
  • Critical for prepaid MVNOs in emerging markets

EPC / IMS Stack: 4G, 5G & VoLTE

EPC (Evolved Packet Core) is the 4G/LTE infrastructure. IMS (IP Multimedia Subsystem) enables voice, video, and rich communication services. Together they form the modern MVNO core.

EPC Core Components

MME (Mobility Management Entity)

Handles UE attach/detach, handover between eNodeBs, security, and paging. Interface: S1 with eNodeB, S6a with HSS, S10/S3 with SGW.

SGW (Serving Gateway)

Local mobility anchor for handover between MMEs. Routes user plane traffic between eNodeB and PGW. S1-U, S5/S8 interfaces.

PGW (PDN Gateway)

Allocates IP address, enforces QoS, interfaces to internet/APN. Gx interface to PCRF for policy; Gy interface to OCS for online charging.

PCRF (Policy Control & Charging Rules Function)

Real-time policy enforcement: QoS, bandwidth throttling, sponsored data. Gx to PGW, Rx to IMS (for voice priority).

IMS Stack (VoLTE & Rich Comms)

CSCF (Call Session Control Function)

Proxy-CSCF (P-CSCF): UE SIP proxy; Interrogating-CSCF (I-CSCF): subscriber lookup; Serving-CSCF (S-CSCF): session control. All use DIAMETER Cx to HSS.

MGCF (Media Gateway Control Function)

Gateway to circuit-switched networks (PSTN). BICC/SIP-I signaling for interoperability with legacy operators.

AS (Application Server)

Hosts supplementary services: call waiting, call forwarding, conference, RCS (Rich Communication Services), messaging.

BGCF (Breakout Gateway Control Function)

Routes SIP calls to PSTN gateways. Handles emergency calls, roaming to circuit-switched networks, trunk selection.

What CelloIP Builds vs Integrates

CelloIP Builds:

  • • Custom BSS (billing, CRM, mediation)
  • • HLR/HSS provisioning & API wrappers
  • • Self-care portals (web/mobile)
  • • DIAMETER/SS7 integration
  • • Revenue assurance & fraud detection

Integrates (via partners):

  • • Ericsson EPC/IMS, Nokia EPC
  • • Open5GS, free5GC (open-source 5G)
  • • Host MNO core network (as MVNE)
  • • Hosted HSS platforms (Mavenir, etc.)
  • • Third-party roaming & eSIM gateways

Code Example: DIAMETER Subscriber Fetch

Below is a realistic Python script using the DIAMETER Cx interface to fetch a subscriber profile from the HSS. This is commonly used during registration or authentication.

# DIAMETER Cx User-Data-Request (UDR) to HSS
# Simulates S-CSCF querying HSS for subscriber profile

import socket
import struct

class DIAMETERCxInterface:
    def __init__(self, hss_host, hss_port=3868):
        self.hss_host = hss_host
        self.hss_port = hss_port
        self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    def encode_avp(self, code, flags, vendor_id, data):
        """Encode DIAMETER AVP (Attribute-Value Pair)"""
        length = 8 + len(data)
        if length % 4:
            length += 4 - (length % 4)

        header = struct.pack('>I', code)
        header += struct.pack('B', flags)
        header += struct.pack('>I', length)[1:]

        if vendor_id:
            header += struct.pack('>I', vendor_id)

        return header + data + b'\x00' * (length - 8 - len(data))

    def fetch_subscriber(self, impu):
        """
        Send User-Data-Request (UDR) to HSS
        IMPU: IMS Public User Identity (e.g., sip:user@domain)
        """
        # Connect to HSS
        self.socket.connect((self.hss_host, self.hss_port))

        # Build DIAMETER message header
        # Cmd-Code: 300 (UDR)
        # Flags: 11000000 (Request, PXY)

        avps = []

        # Session-Id
        session_id = b"mvno.example.com;12345"
        avps.append(self.encode_avp(263, 0x40, 0, session_id))

        # Origin-Host (FQDN of S-CSCF)
        origin_host = b"scscf.mvno.example.com"
        avps.append(self.encode_avp(264, 0x40, 0, origin_host))

        # Origin-Realm
        origin_realm = b"mvno.example.com"
        avps.append(self.encode_avp(296, 0x40, 0, origin_realm))

        # Destination-Host (HSS)
        dest_host = b"hss.mvno.example.com"
        avps.append(self.encode_avp(293, 0x40, 0, dest_host))

        # Destination-Realm
        dest_realm = b"mvno.example.com"
        avps.append(self.encode_avp(283, 0x40, 0, dest_realm))

        # Public-Identity (IMPU) - 3GPP specific
        # AVP Code: 1657 (Public-Identity)
        avps.append(self.encode_avp(1657, 0xc0, 10415, impu.encode()))

        # Auth-Session-State: NO_STATE_MAINTAINED
        avps.append(self.encode_avp(277, 0x40, 0, struct.pack('>I', 1)))

        # Combine AVPs
        message_body = b"".join(avps)

        # DIAMETER Header: Version (1 byte) + Length (3 bytes) + Flags + Cmd-Code
        version = 0x01
        length = 20 + len(message_body)
        header = struct.pack('B', version)
        header += struct.pack('>I', length)[1:]  # 3-byte length
        header += struct.pack('B', 0xc0)  # Flags: Request, Proxiable
        header += struct.pack('>I', 300)[1:]  # Cmd-Code: 300 (UDR)
        header += struct.pack('>I', 0)  # App-Id: 16777216 (3GPP IMS)
        header += struct.pack('>I', 12345)  # Hop-by-Hop ID
        header += struct.pack('>I', 67890)  # End-to-End ID

        # Send message
        self.socket.send(header + message_body)

        # Receive UDR from HSS
        response = self.socket.recv(4096)
        return self.parse_response(response)

    def parse_response(self, data):
        """Parse User-Data-Answer (UDA) from HSS"""
        # Simplified parsing
        result = {
            'result_code': None,
            'subscriber_profile': None,
            'subscription_status': None,
        }

        # Extract Result-Code AVP (268)
        if b'\x01\x0c' in data:  # Simplified check
            result['result_code'] = 'DIAMETER_SUCCESS'
            result['subscriber_profile'] = {
                'impu': 'sip:[email protected]',
                'impi': '[email protected]',
                'subscription_state': 'ACTIVE',
                'service_profile': {
                    'initial_filter_criteria': [
                        'Allow voice calls',
                        'Allow SMS',
                        'Allow data (LTE)',
                    ]
                }
            }

        return result


# Usage example
if __name__ == '__main__':
    hss_client = DIAMETERCxInterface('hss.mvno.example.com', 3868)

    result = hss_client.fetch_subscriber('sip:[email protected]')

    print("HSS Query Result:", result)
    print("Subscriber Active:", result['subscriber_profile']['subscription_state'])

Key Takeaways

  • • DIAMETER uses AVP (Attribute-Value Pair) encoding for flexibility and extensibility
  • • Cx interface is between S-CSCF (SIP server) and HSS (subscriber database)
  • • User-Data-Request fetches complete subscriber profile for authentication/authorization
  • • IMPU (Public Identity) and IMPI (Private Identity) are IMS-specific identifiers
  • • Production HSS queries return detailed service profiles, subscription state, charging info

MVNO Tiers Comparison

Different MVNO models suit different business goals and budget levels.

TierBSS OwnershipOSS OwnershipHLR TypeBilling ControlCost RangeTime-to-Market
Light MVNOPartner-hostedHost MNOHost MNO HLRShared (wholesale rates)$40K–$80K8–12 weeks
Full MVNODedicatedShared HLR, own provisioningDedicated HLR/HSSFull control$120K–$250K20–28 weeks
Enterprise MNOCustom buildComplete native stackEnterprise HLR + HSS clusterComplete control$300K+32–52 weeks

Integration Ecosystem

An MVNO platform doesn't exist in isolation. It must integrate with multiple external partners and systems to provide complete telecom services.

Host MNO

Wholesale access, SS7/SIGTRAN interconnect, roaming agreements

GRX/IPX

International roaming, inter-operator IP exchange

SMS Firewall

Fraud detection, A2P filtering, DLT compliance

MNP Registry

Number portability, SPID management, porting workflows

GSMA eSIM/RSP

OTA SIM provisioning, remote profiles, multi-IMSI support

Key Integration Points

Host MNO Interconnect (SS7/SIGTRAN)

The MVNO connects to the host MNO's network via SS7 or SIGTRAN. This provides cellular access and enables roaming. Typically handled via dedicated leased lines or VPN.

GRX/IPX Roaming

Global Roaming eXchange (GRX) for 3G/4G allows subscribers to roam internationally. IPX (IP eXchange) is the modern equivalent. Both require DIAMETER gateways and peering agreements.

SMS Firewall & A2P Gateway

Enterprise SMS (A2P: Application-to-Person) flows through third-party gateways for fraud detection, DLT (Distributed Ledger for Message Routing) compliance, and filtering.

MNP Registry & SPID Management

Number Portability requires integration with national MNP registries. Service Provider ID (SPID) routing is essential for call delivery when a subscriber ports their number.

GSMA eSIM & Remote SIM Provisioning

Modern MVNOs support eSIM via GSMA RSP (Remote SIM Provisioning). Profiles are downloaded OTA to compatible devices, enabling multi-IMSI support and instant activation.

MVNO Platform Pricing & Engagement Models

CelloIP offers three engagement tiers to fit different scale and complexity requirements. All pricing includes deployment, initial training, and 6 months of support.

Light MVNO BSS

$40K–$80K
12 weeks
  • Prepaid & postpaid billing
  • Web-based self-care portal
  • Partner-hosted infrastructure
  • Basic CRM
  • CDR integration (3rd-party)
  • Email support

Full MVNO Platform

$120K–$250K
24 weeks
  • Everything in Light, plus:
  • Dedicated HLR/HSS
  • Own network provisioning
  • Advanced revenue assurance
  • DIAMETER/SS7 signaling
  • Number portability (MNP)
  • Roaming (GRX/IPX)
  • Disaster recovery setup
  • 24/7 support

Enterprise MNO Stack

$300K+
36 weeks
  • Everything in Full, plus:
  • Custom EPC/IMS core
  • VoLTE infrastructure
  • USSD/SMSC custom build
  • Fraud management engine
  • IoT SIM management
  • Custom APIs
  • Performance optimization
  • Dedicated engineering team

Pricing Notes

  • Hosting: On-premise, AWS, Azure, or managed private cloud available
  • Licensing: Per-subscriber annual fees (Light: $0.50–$1.00; Full: $1.50–$3.00; Enterprise: custom)
  • Support Tiers: Email (included), 24/5 phone, or 24/7 SLA-backed support available at extra cost
  • Customization: Scoped projects for additional integrations or feature development billed at $150–$300/hour
  • Training: On-site or remote operator training (4–20 days) included in deployment cost

Frequently Asked Questions

What is MVNO BSS/OSS?

BSS (Business Support Systems) handles billing, CRM, and revenue management. OSS (Operational Support Systems) manages network provisioning, inventory, and fault management. Together they form the complete telecom operating platform for an MVNO.

What does an MVNO core network include?

A full MVNO core includes HLR/HSS (subscriber database), SMSC (SMS center), USSD gateway, DIAMETER/SS7 signaling, EPC (4G) or IMS (VoLTE) stack, roaming agreements (GRX/IPX), and integration with MNO interconnect points.

What is the difference between HLR and HSS?

HLR (Home Location Register) serves 2G/3G networks managing location and authentication. HSS (Home Subscriber Server) is the 4G/5G equivalent, storing subscriber profiles, service authorization, and QoS policies in real-time databases.

Can an MVNO support VoLTE?

Yes. VoLTE requires IMS (IP Multimedia Subsystem) infrastructure, including CSCF (Call Session Control Function), HSS, and PCRF for policy control. MVNOs can build IMS natively or lease it from the host MNO.

What is the difference between DIAMETER and SS7?

SS7 is legacy circuit-switched signaling (2G/3G). DIAMETER is modern packet-based signaling (4G/5G LTE), used for authentication, charging, policy, and roaming via Cx/Dx interfaces.

Can an MVNO offer 5G services?

Yes, if the host MNO has 5G infrastructure. The MVNO integrates via NSSF (Network Slicing Selection Function) and manages 5G subscribers through the HSS/UDM. Full 5G core deployment is typically reserved for larger operators.

How long does it take to build a complete MVNO platform?

Light MVNO (BSS only, hosted OSS): 8–12 weeks. Full MVNO (native BSS + OSS): 20–28 weeks. Enterprise MNO stack (custom EPC/IMS/HLR): 32–52 weeks. Timeline depends on customization, compliance, and team size.

What hosting and compliance options does CelloIP provide?

We offer on-premise deployment, private cloud (AWS, Azure), or managed cloud hosting. All platforms comply with GSMA standards, GDPR/CCPA data regulations, telecom operator SLAs (99.99% uptime), and local telecom licensing requirements.

Should I build a custom MVNO platform or buy an off-the-shelf BSS/OSS?

Buy a packaged platform (Cerillion, Gigs, Wavelo, Lifecycle) if you want fastest time-to-market and your requirements fit their templates — but you pay recurring per-subscriber fees and accept their roadmap. Build custom when you need differentiated products, full data ownership, no per-subscriber licensing, or integration with systems the packaged vendors do not support. Custom development has higher upfront cost but no perpetual platform fees and complete control. CelloIP builds custom MVNO platforms you own outright.

How much does it cost to build an MVNO platform?

Light MVNO (BSS only, hosted OSS): $40K–$80K. Full MVNO (dedicated BSS + OSS): $120K–$250K. Enterprise MNO stack (custom EPC/IMS/HLR): $300K+. Custom development means no recurring per-subscriber platform fees — unlike packaged BSS vendors who charge ongoing per-SIM or per-subscriber licensing that scales with your growth.

What is the difference between MVNO, MVNE, and MVNA?

An MVNO (Mobile Virtual Network Operator) sells mobile service under its own brand using a host network. An MVNE (Mobile Virtual Network Enabler) provides the BSS/OSS platform and technical infrastructure that MVNOs run on. An MVNA (Mobile Virtual Network Aggregator) sits between the MNO and multiple MVNOs, aggregating wholesale capacity. CelloIP builds platforms for all three roles.

Can I avoid per-subscriber licensing fees with a custom MVNO platform?

Yes — that is one of the main reasons operators choose custom development over packaged BSS vendors. Packaged platforms typically charge ongoing per-subscriber or per-SIM fees that grow with your base. A custom-built platform you own has only your infrastructure and maintenance costs, making it dramatically more economical at scale (typically above 50,000–100,000 subscribers).