MVNO BSS/OSS Platform Architecture
Complete technical guide to designing, building, and operating a production telecom stack for MVNOs.
Full BSS/OSS Stack
HLR + EPC + IMS
DIAMETER/SS7 Ready
GSMA Compliant
Published: April 15, 2026 | By Kaushik Parmar, Founder & VoIP Architect, CelloIP Technologies
What is MVNO BSS/OSS?
BSS (Business Support Systems) handles billing, CRM, and revenue management. OSS (Operational Support Systems) manages network provisioning, inventory, and fault management. Together they form the complete telecom operating platform for an MVNO.
What does an MVNO core network include?
A full MVNO core includes HLR/HSS (subscriber database), SMSC (SMS center), USSD gateway, DIAMETER/SS7 signaling, EPC (4G) or IMS (VoLTE) stack, roaming agreements (GRX/IPX), and integration with MNO interconnect points.
Table of Contents
BSS Architecture Deep Dive
The Business Support Systems layer manages all customer-facing and revenue-generating operations. From prepaid/postpaid billing to CRM and revenue assurance, BSS is the financial backbone of an MVNO.
Billing Engine
Prepaid/postpaid processing, threshold management, invoice generation
CRM System
Subscriber management, lifecycle automation, customer portals
Mediation Platform
CDR collection, rating, aggregation from multiple sources
Rating Engine
Real-time tariff application, discount logic, promotion rules
Revenue Assurance
Leakage detection, reconciliation, audit trails
BSS Sub-Components
Prepaid Billing
Real-time balance management, USSD checks, automatic top-up triggers, and threshold-based service suspension. Typically powered by IN (Intelligent Network) or DIAMETER interfaces.
Postpaid Billing
Invoice generation, payment settlement, late-payment dunning, and credit control. Integrates with mediation for accurate CDR rating.
Mediation Platform
Aggregates CDRs from MSC, SMSC, APN gateway, IMS, and other network elements. Applies rating rules, deduplication, and data normalization before sending to billing.
Rating Engine
Applies tariff plans, discount rules, and promotional logic in real-time. Calculates call/SMS/data charges based on subscriber profile and service plan.
Revenue Assurance
Detects leakage between network elements and billing. Reconciles settlement with MNO interconnect, audits data integrity, and flags anomalies.
OSS Architecture Deep Dive
The Operational Support Systems layer manages the network infrastructure—from service provisioning and inventory tracking to fault management and capacity planning. OSS ensures the network runs reliably and efficiently.
Network Provisioning
Service instantiation, activation workflows, auto-configuration
Inventory Management
HLR records, IMSI/IMEI tracking, SIM provisioning
Fault Management
Alarms, SLA monitoring, incident resolution
Number Portability
MNP integration, porting workflows, SPID management
Capacity Planning
Subscriber growth forecasting, resource allocation
Provisioning Workflow
- Customer places order through self-care portal or sales team
- OSS receives service request via SOAP/REST API or SFTP
- Provisioning engine validates subscriber, service, and SIM status
- HLR insertion: IMSI → IMEI mapping, service profile, APN assignment
- Billing system activation: rating plan, credit limit, service flags
- Confirmation sent to customer via email/SMS
- OSS continues monitoring for activation completion and alarms
HLR/HSS & Core Network Components
The HLR (Home Location Register) and HSS (Home Subscriber Server) are the authoritative subscriber databases. They store authentication credentials, service profiles, and authorization rules for every subscriber on the network.
Architecture Diagram: Core Network Flow
┌─────────────────────────────────────────────────────────────────┐
│ MVNO CORE NETWORK │
└─────────────────────────────────────────────────────────────────┘
UE (Phone)
↓ (DIAMETER Cx/Dx)
│
MME (Mobility Management) ←→ HSS (Home Subscriber Server)
↓ ↑ (Diameter Cx)
SGW (Serving Gateway) │
↓ │
PGW (PDN Gateway) ────────→ PCRF (Policy Control)
↓ │
[Internet / APN] (Diameter Gx)
↓
BSS (Billing) ←──CDR──── SMSC / USSD Gateway
↓
Revenue Assurance & Mediation
Key Signaling Paths:
• Cx: Home Subscriber Server (HSS) ←→ MME/S-CSCF (DIAMETER)
• Dx: HSS ←→ Other HSS (Inter-operator, DIAMETER)
• Gx: PGW ←→ PCRF (Policy enforcement, DIAMETER)
• S6a: Evolved MSC ←→ HSS (Location update, DIAMETER)
• Sy: Policy Server ←→ PCRF (Charging/policy sync, DIAMETER)
2G/3G HLR (Legacy)
- •Stores IMSI, Ki (authentication key), MSISDN
- •Handles MAP (Mobile Application Part) signaling via SS7
- •Manages location area, roaming restrictions
- •Supports ODB (Operator Determined Barring) rules
- •Typical capacity: 100M–500M subscribers
4G/5G HSS
- •NoSQL database (Cassandra, MongoDB) for horizontal scaling
- •Stores UE Profile, EPS subscription, QoS parameters
- •DIAMETER Cx interface to MME/S-CSCF
- •Supports IMS, VoLTE, 5G SA (Standalone) networks
- •Real-time consistency: ~10ms query response
AuC (Authentication Center)
- •Generates authentication vectors (K, RAND, AUTN, XRES)
- •Protects against replay attacks and unauthorized access
- •Can be co-located with HLR or separate module
- •DIAMETER S6a interface to MME
- •Critical for 5G: implements MILENAGE/AKA-prime
EIR (Equipment Identity Register)
- •Tracks IMEI (handset identity) status
- •Blacklist management for lost/stolen devices
- •IMEI-IMSI binding validation
- •Fraud detection: unusual device/location combinations
- •Can be internal or shared with MNO
SMSC (Short Message Service Center)
- •Stores & forwards SMS messages
- •Handles MT (Mobile Terminated) routing
- •Can be MNO-hosted or dedicated MVNO instance
- •GTP-C interface to GGSN for delivery
- •Supports SMS-based OTPs, alerts, 2FA
USSD Gateway
- •Unstructured Supplementary Service Data: menu-driven access
- •Real-time balance checks, top-up, service activation
- •MAP SS7 interface for legacy networks
- •Diameter/REST APIs for modern deployments
- •Critical for prepaid MVNOs in emerging markets
EPC / IMS Stack: 4G, 5G & VoLTE
EPC (Evolved Packet Core) is the 4G/LTE infrastructure. IMS (IP Multimedia Subsystem) enables voice, video, and rich communication services. Together they form the modern MVNO core.
EPC Core Components
MME (Mobility Management Entity)
Handles UE attach/detach, handover between eNodeBs, security, and paging. Interface: S1 with eNodeB, S6a with HSS, S10/S3 with SGW.
SGW (Serving Gateway)
Local mobility anchor for handover between MMEs. Routes user plane traffic between eNodeB and PGW. S1-U, S5/S8 interfaces.
PGW (PDN Gateway)
Allocates IP address, enforces QoS, interfaces to internet/APN. Gx interface to PCRF for policy; Gy interface to OCS for online charging.
PCRF (Policy Control & Charging Rules Function)
Real-time policy enforcement: QoS, bandwidth throttling, sponsored data. Gx to PGW, Rx to IMS (for voice priority).
IMS Stack (VoLTE & Rich Comms)
CSCF (Call Session Control Function)
Proxy-CSCF (P-CSCF): UE SIP proxy; Interrogating-CSCF (I-CSCF): subscriber lookup; Serving-CSCF (S-CSCF): session control. All use DIAMETER Cx to HSS.
MGCF (Media Gateway Control Function)
Gateway to circuit-switched networks (PSTN). BICC/SIP-I signaling for interoperability with legacy operators.
AS (Application Server)
Hosts supplementary services: call waiting, call forwarding, conference, RCS (Rich Communication Services), messaging.
BGCF (Breakout Gateway Control Function)
Routes SIP calls to PSTN gateways. Handles emergency calls, roaming to circuit-switched networks, trunk selection.
What CelloIP Builds vs Integrates
CelloIP Builds:
- • Custom BSS (billing, CRM, mediation)
- • HLR/HSS provisioning & API wrappers
- • Self-care portals (web/mobile)
- • DIAMETER/SS7 integration
- • Revenue assurance & fraud detection
Integrates (via partners):
- • Ericsson EPC/IMS, Nokia EPC
- • Open5GS, free5GC (open-source 5G)
- • Host MNO core network (as MVNE)
- • Hosted HSS platforms (Mavenir, etc.)
- • Third-party roaming & eSIM gateways
Code Example: DIAMETER Subscriber Fetch
Below is a realistic Python script using the DIAMETER Cx interface to fetch a subscriber profile from the HSS. This is commonly used during registration or authentication.
# DIAMETER Cx User-Data-Request (UDR) to HSS
# Simulates S-CSCF querying HSS for subscriber profile
import socket
import struct
class DIAMETERCxInterface:
def __init__(self, hss_host, hss_port=3868):
self.hss_host = hss_host
self.hss_port = hss_port
self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
def encode_avp(self, code, flags, vendor_id, data):
"""Encode DIAMETER AVP (Attribute-Value Pair)"""
length = 8 + len(data)
if length % 4:
length += 4 - (length % 4)
header = struct.pack('>I', code)
header += struct.pack('B', flags)
header += struct.pack('>I', length)[1:]
if vendor_id:
header += struct.pack('>I', vendor_id)
return header + data + b'\x00' * (length - 8 - len(data))
def fetch_subscriber(self, impu):
"""
Send User-Data-Request (UDR) to HSS
IMPU: IMS Public User Identity (e.g., sip:user@domain)
"""
# Connect to HSS
self.socket.connect((self.hss_host, self.hss_port))
# Build DIAMETER message header
# Cmd-Code: 300 (UDR)
# Flags: 11000000 (Request, PXY)
avps = []
# Session-Id
session_id = b"mvno.example.com;12345"
avps.append(self.encode_avp(263, 0x40, 0, session_id))
# Origin-Host (FQDN of S-CSCF)
origin_host = b"scscf.mvno.example.com"
avps.append(self.encode_avp(264, 0x40, 0, origin_host))
# Origin-Realm
origin_realm = b"mvno.example.com"
avps.append(self.encode_avp(296, 0x40, 0, origin_realm))
# Destination-Host (HSS)
dest_host = b"hss.mvno.example.com"
avps.append(self.encode_avp(293, 0x40, 0, dest_host))
# Destination-Realm
dest_realm = b"mvno.example.com"
avps.append(self.encode_avp(283, 0x40, 0, dest_realm))
# Public-Identity (IMPU) - 3GPP specific
# AVP Code: 1657 (Public-Identity)
avps.append(self.encode_avp(1657, 0xc0, 10415, impu.encode()))
# Auth-Session-State: NO_STATE_MAINTAINED
avps.append(self.encode_avp(277, 0x40, 0, struct.pack('>I', 1)))
# Combine AVPs
message_body = b"".join(avps)
# DIAMETER Header: Version (1 byte) + Length (3 bytes) + Flags + Cmd-Code
version = 0x01
length = 20 + len(message_body)
header = struct.pack('B', version)
header += struct.pack('>I', length)[1:] # 3-byte length
header += struct.pack('B', 0xc0) # Flags: Request, Proxiable
header += struct.pack('>I', 300)[1:] # Cmd-Code: 300 (UDR)
header += struct.pack('>I', 0) # App-Id: 16777216 (3GPP IMS)
header += struct.pack('>I', 12345) # Hop-by-Hop ID
header += struct.pack('>I', 67890) # End-to-End ID
# Send message
self.socket.send(header + message_body)
# Receive UDR from HSS
response = self.socket.recv(4096)
return self.parse_response(response)
def parse_response(self, data):
"""Parse User-Data-Answer (UDA) from HSS"""
# Simplified parsing
result = {
'result_code': None,
'subscriber_profile': None,
'subscription_status': None,
}
# Extract Result-Code AVP (268)
if b'\x01\x0c' in data: # Simplified check
result['result_code'] = 'DIAMETER_SUCCESS'
result['subscriber_profile'] = {
'impu': 'sip:[email protected]',
'impi': '[email protected]',
'subscription_state': 'ACTIVE',
'service_profile': {
'initial_filter_criteria': [
'Allow voice calls',
'Allow SMS',
'Allow data (LTE)',
]
}
}
return result
# Usage example
if __name__ == '__main__':
hss_client = DIAMETERCxInterface('hss.mvno.example.com', 3868)
result = hss_client.fetch_subscriber('sip:[email protected]')
print("HSS Query Result:", result)
print("Subscriber Active:", result['subscriber_profile']['subscription_state'])
Key Takeaways
- • DIAMETER uses AVP (Attribute-Value Pair) encoding for flexibility and extensibility
- • Cx interface is between S-CSCF (SIP server) and HSS (subscriber database)
- • User-Data-Request fetches complete subscriber profile for authentication/authorization
- • IMPU (Public Identity) and IMPI (Private Identity) are IMS-specific identifiers
- • Production HSS queries return detailed service profiles, subscription state, charging info
MVNO Tiers Comparison
Different MVNO models suit different business goals and budget levels.
Integration Ecosystem
An MVNO platform doesn't exist in isolation. It must integrate with multiple external partners and systems to provide complete telecom services.
Host MNO
Wholesale access, SS7/SIGTRAN interconnect, roaming agreements
GRX/IPX
International roaming, inter-operator IP exchange
SMS Firewall
Fraud detection, A2P filtering, DLT compliance
MNP Registry
Number portability, SPID management, porting workflows
GSMA eSIM/RSP
OTA SIM provisioning, remote profiles, multi-IMSI support
Key Integration Points
Host MNO Interconnect (SS7/SIGTRAN)
The MVNO connects to the host MNO's network via SS7 or SIGTRAN. This provides cellular access and enables roaming. Typically handled via dedicated leased lines or VPN.
GRX/IPX Roaming
Global Roaming eXchange (GRX) for 3G/4G allows subscribers to roam internationally. IPX (IP eXchange) is the modern equivalent. Both require DIAMETER gateways and peering agreements.
SMS Firewall & A2P Gateway
Enterprise SMS (A2P: Application-to-Person) flows through third-party gateways for fraud detection, DLT (Distributed Ledger for Message Routing) compliance, and filtering.
MNP Registry & SPID Management
Number Portability requires integration with national MNP registries. Service Provider ID (SPID) routing is essential for call delivery when a subscriber ports their number.
GSMA eSIM & Remote SIM Provisioning
Modern MVNOs support eSIM via GSMA RSP (Remote SIM Provisioning). Profiles are downloaded OTA to compatible devices, enabling multi-IMSI support and instant activation.
MVNO Platform Pricing & Engagement Models
CelloIP offers three engagement tiers to fit different scale and complexity requirements. All pricing includes deployment, initial training, and 6 months of support.
Light MVNO BSS
- ✓Prepaid & postpaid billing
- ✓Web-based self-care portal
- ✓Partner-hosted infrastructure
- ✓Basic CRM
- ✓CDR integration (3rd-party)
- ✓Email support
Full MVNO Platform
- ✓Everything in Light, plus:
- ✓Dedicated HLR/HSS
- ✓Own network provisioning
- ✓Advanced revenue assurance
- ✓DIAMETER/SS7 signaling
- ✓Number portability (MNP)
- ✓Roaming (GRX/IPX)
- ✓Disaster recovery setup
- ✓24/7 support
Enterprise MNO Stack
- ✓Everything in Full, plus:
- ✓Custom EPC/IMS core
- ✓VoLTE infrastructure
- ✓USSD/SMSC custom build
- ✓Fraud management engine
- ✓IoT SIM management
- ✓Custom APIs
- ✓Performance optimization
- ✓Dedicated engineering team
Pricing Notes
- • Hosting: On-premise, AWS, Azure, or managed private cloud available
- • Licensing: Per-subscriber annual fees (Light: $0.50–$1.00; Full: $1.50–$3.00; Enterprise: custom)
- • Support Tiers: Email (included), 24/5 phone, or 24/7 SLA-backed support available at extra cost
- • Customization: Scoped projects for additional integrations or feature development billed at $150–$300/hour
- • Training: On-site or remote operator training (4–20 days) included in deployment cost
Frequently Asked Questions
What is MVNO BSS/OSS?
BSS (Business Support Systems) handles billing, CRM, and revenue management. OSS (Operational Support Systems) manages network provisioning, inventory, and fault management. Together they form the complete telecom operating platform for an MVNO.
What does an MVNO core network include?
A full MVNO core includes HLR/HSS (subscriber database), SMSC (SMS center), USSD gateway, DIAMETER/SS7 signaling, EPC (4G) or IMS (VoLTE) stack, roaming agreements (GRX/IPX), and integration with MNO interconnect points.
What is the difference between HLR and HSS?
HLR (Home Location Register) serves 2G/3G networks managing location and authentication. HSS (Home Subscriber Server) is the 4G/5G equivalent, storing subscriber profiles, service authorization, and QoS policies in real-time databases.
Can an MVNO support VoLTE?
Yes. VoLTE requires IMS (IP Multimedia Subsystem) infrastructure, including CSCF (Call Session Control Function), HSS, and PCRF for policy control. MVNOs can build IMS natively or lease it from the host MNO.
What is the difference between DIAMETER and SS7?
SS7 is legacy circuit-switched signaling (2G/3G). DIAMETER is modern packet-based signaling (4G/5G LTE), used for authentication, charging, policy, and roaming via Cx/Dx interfaces.
Can an MVNO offer 5G services?
Yes, if the host MNO has 5G infrastructure. The MVNO integrates via NSSF (Network Slicing Selection Function) and manages 5G subscribers through the HSS/UDM. Full 5G core deployment is typically reserved for larger operators.
How long does it take to build a complete MVNO platform?
Light MVNO (BSS only, hosted OSS): 8–12 weeks. Full MVNO (native BSS + OSS): 20–28 weeks. Enterprise MNO stack (custom EPC/IMS/HLR): 32–52 weeks. Timeline depends on customization, compliance, and team size.
What hosting and compliance options does CelloIP provide?
We offer on-premise deployment, private cloud (AWS, Azure), or managed cloud hosting. All platforms comply with GSMA standards, GDPR/CCPA data regulations, telecom operator SLAs (99.99% uptime), and local telecom licensing requirements.
Should I build a custom MVNO platform or buy an off-the-shelf BSS/OSS?
Buy a packaged platform (Cerillion, Gigs, Wavelo, Lifecycle) if you want fastest time-to-market and your requirements fit their templates — but you pay recurring per-subscriber fees and accept their roadmap. Build custom when you need differentiated products, full data ownership, no per-subscriber licensing, or integration with systems the packaged vendors do not support. Custom development has higher upfront cost but no perpetual platform fees and complete control. CelloIP builds custom MVNO platforms you own outright.
How much does it cost to build an MVNO platform?
Light MVNO (BSS only, hosted OSS): $40K–$80K. Full MVNO (dedicated BSS + OSS): $120K–$250K. Enterprise MNO stack (custom EPC/IMS/HLR): $300K+. Custom development means no recurring per-subscriber platform fees — unlike packaged BSS vendors who charge ongoing per-SIM or per-subscriber licensing that scales with your growth.
What is the difference between MVNO, MVNE, and MVNA?
An MVNO (Mobile Virtual Network Operator) sells mobile service under its own brand using a host network. An MVNE (Mobile Virtual Network Enabler) provides the BSS/OSS platform and technical infrastructure that MVNOs run on. An MVNA (Mobile Virtual Network Aggregator) sits between the MNO and multiple MVNOs, aggregating wholesale capacity. CelloIP builds platforms for all three roles.
Can I avoid per-subscriber licensing fees with a custom MVNO platform?
Yes — that is one of the main reasons operators choose custom development over packaged BSS vendors. Packaged platforms typically charge ongoing per-subscriber or per-SIM fees that grow with your base. A custom-built platform you own has only your infrastructure and maintenance costs, making it dramatically more economical at scale (typically above 50,000–100,000 subscribers).
Get Started Building Your MVNO Platform Today
CelloIP provides end-to-end design, development, and deployment of production MVNO platforms. Our telecom engineers bring decades of operator experience.
Full MVNO Platform Development
Custom BSS, OSS, HLR/HSS, DIAMETER signaling, and integration layer design.
Learn moreHire Telecom Engineers
Dedicated developers with expertise in HLR, DIAMETER, SS7, EPC/IMS, and billing systems.
View teamSchedule a Discovery Call
30-min technical consultation to discuss your MVNO requirements and timeline.
Contact us