SIG-SIM · SIG-ICX · Architecture

MVNO ↔ Carrier Architecture

How a Mobile Virtual Network Operator (MVNO) integrates with a carrier (MNO) using Signal Telecom Suite. Covers SIM provisioning, AKA authentication, BTS attachment, and the full subscriber lifecycle.

1. The Players

Entity	Role	Owns
MNO (Carrier)	Mobile Network Operator — owns physical infrastructure	Spectrum license, BTS towers, core network (EPC/5GC), HLR/HSS
MVNO	Virtual operator — resells carrier capacity under own brand	SIM cards, customer relationships, billing, brand
BTS	Base Transceiver Station — the physical radio tower	Owned by MNO, used by MVNO subscribers
HSS/HLR	Home Subscriber Server — authenticates SIMs on the network	Shared between MNO and MVNO (or MVNO runs own via Open5GS)
Subscriber	End user with an MVNO SIM card	SIM card, phone number (MSISDN)

2. Network Architecture

MVNO (Signal Telecom Suite)

SIG-SIM

SIM Mgmt

SIG-BILL

Billing

SIG-RATE

Rating

SIG-ID

CRM

SIG-ICX

Interconnect

Open5GS HSS

Stores Ki/OPc · Generates AKA auth vectors

↓

S6a / Diameter interface (or carrier HSS API)

↓

MNO / Carrier Network

HSS/HLR

Auth DB

MME

Mobility

SGW

Serving GW

PGW

PDN GW

↓

EPC Core Network (4G/LTE)

↓

BTS/eNB

Tower 1

BTS/eNB

Tower 2

BTS/eNB

Tower 3

↓

Radio (Uu interface)

↓

📱

MVNO SIM

📱

MVNO SIM

📱

MNO SIM

3. AKA Authentication (Authentication and Key Agreement)

When an MVNO subscriber's phone connects to a BTS, the network must verify the SIM is legitimate. This uses the AKA protocol — a challenge-response mechanism based on shared secret keys.

3.1 Key Material (stored in SIG-SIM)

Key	Size	Stored In	Purpose
Ki	128 bits	SIM card + HSS	Master subscriber key — never transmitted over air
OPc	128 bits	SIM card + HSS	Operator variant key — derived from OP using Ki
IMSI	15 digits	SIM card + HSS	International Mobile Subscriber Identity
AMF	16 bits	HSS	Authentication Management Field (default: 0x8000)

Signal Telecom Suite — SIM Card Model

class SIMCard(Base):
    iccid    # Physical card ID (20-22 digits, printed on SIM)
    imsi     # Network identity (15 digits, MCC+MNC+MSIN)
    msisdn   # Phone number (assigned on activation)
    ki       # 128-bit subscriber key (hex, shared with HSS)
    opc      # 128-bit operator variant key (hex)
    amf      # Authentication Management Field (default "8000")
    pin/puk  # User PIN codes
    status   # available -> assigned -> active -> suspended -> deactivated

3.2 AKA Authentication Flow

Subscriber (UE)

BTS / eNB

MME

HSS

IMSI →

→

1. Attach Request — phone sends IMSI to nearest tower

IMSI →

→

2. BTS forwards to MME (Mobility Management Entity)

IMSI →

→

3. MME requests auth vectors from HSS for this IMSI

HSS looks up Ki, OPc
Generates RAND, XRES,
AUTN, Kasme

←

← vectors

4. HSS returns auth vector (RAND, XRES, AUTN, Kasme)

← challenge

←

5. Auth challenge sent to phone (RAND + AUTN)

SIM computes RES
using Ki + RAND
Verifies AUTN

RES →

→

6. Phone sends response (RES) — MME checks RES == XRES

← connected!

←

7. Attach Accept — subscriber is on the network

3.3 Why the MVNO Needs This

SIM Provisioning — When the MVNO orders SIMs from a manufacturer, each SIM comes with a unique Ki/OPc pair. These must be loaded into both the physical SIM and the HSS.
HSS Sync — The MVNO's SIG-SIM module stores Ki/OPc and syncs them to the carrier's HSS (or the MVNO's own Open5GS HSS) via the S6a/Diameter interface.
Without Ki/OPc — The subscriber's phone cannot authenticate on any BTS. The attach request will be rejected.

4. MVNO Provisioning Flow (End-to-End)

SIM Manufacturing

SIM vendor delivers batch. MVNO receives SIMs with Ki/OPc per card. Import into SIG-SIM.

POST /api/v1/mvno/sims

available

Customer Onboarding

Customer signs up. SIG-ID creates identity. KYC verification.

POST /api/v1/customers/

active

SIM Assignment & Activation

Assign SIM to customer. Assign MSISDN (phone number). Link to customer identity.

POST /api/v1/mvno/sims/{iccid}/activate

active

HSS Provisioning

Push Ki/OPc/IMSI to carrier HSS (or Open5GS). HSS can now generate auth vectors for this subscriber.

SIG-SIM → S6a/Diameter → HSS

provisioned_in_hss: active

Subscriber Attaches to BTS

Phone powers on, connects to nearest BTS. AKA authentication completes. Subscriber gets IP address.

BTS → MME → HSS (automatic)

connected

Usage & Billing

Carrier sends CDRs (Call Detail Records) to MVNO. SIG-RATE rates the usage. SIG-BILL generates invoice.

POST /api/v1/rating/usage → POST /api/v1/rating/rate → POST /api/v1/billing/invoices

Interconnect Settlement

SIG-ICX tracks carrier rates and settlement. MVNO pays carrier wholesale. Margin = retail − wholesale.

GET /api/v1/icx/carriers

5. BTS and the MVNO

Key Point: The MVNO Does NOT Own BTS Towers

The MVNO leases radio capacity from the MNO (carrier). The carrier's BTS towers serve both the carrier's own subscribers and the MVNO's subscribers. The BTS doesn't distinguish between them — authentication happens at the HSS level.

Aspect	MNO (Carrier)	MVNO
BTS/Towers	Owns and operates	Uses via agreement
Spectrum	Licensed from regulator	No spectrum needed
Core Network	Owns EPC/5GC	May run own HSS (Open5GS) or use carrier's
SIM Cards	Issues own SIMs	Issues own SIMs (different MNC)
Billing	Bills own customers	Bills own customers + pays carrier wholesale
Brand	Own brand	Own brand (customers don't know about carrier)

6. Signal Telecom Suite API Endpoints

Module	Endpoint	Purpose
SIG-SIM	`POST /api/v1/mvno/sims`	Register SIM with ICCID, IMSI, Ki, OPc
SIG-SIM	`POST /api/v1/mvno/sims/{iccid}/activate`	Assign MSISDN, bind to customer, trigger HSS
SIG-SIM	`GET /api/v1/mvno/sims`	List SIM inventory by status
SIG-ICX	`POST /api/v1/icx/carriers`	Register carrier partner (MVNO host)
SIG-ICX	`GET /api/v1/icx/catalog`	Browse 29+ carriers worldwide
SIG-ID	`POST /api/v1/customers/`	Create subscriber identity
SIG-RATE	`POST /api/v1/rating/usage`	Record CDR usage from carrier
SIG-BILL	`POST /api/v1/billing/invoices`	Generate subscriber invoice

7. MVNO Types Supported

Type	Description	Signal Suite Role
Full MVNO	Runs own core network (HSS, SMSC, GGSN). Maximum control.	SIG-SIM manages HSS via Open5GS integration
Light MVNO	Uses carrier's core but has own SIMs and billing. Most common.	SIG-SIM + SIG-BILL + SIG-ICX for carrier settlement
Branded Reseller	Carrier handles everything, MVNO is just a brand.	SIG-ID + SIG-BILL only (minimal integration)

Try the MVNO APIs

Open MVNO & Interconnect Swagger UI →