Subscriber data management (SDM) is the part of a mobile network that stores who a subscriber is, what they are allowed to use, and where their sessions currently live. Every attach, call setup, and data session asks it the same question: does this identity exist, and what is it entitled to?
The name covers a family of 3GPP network functions rather than one box. In 5G those are the Unified Data Management (UDM), the Unified Data Repository (UDR), and the Authentication Server Function (AUSF). In 4G the same job belonged to the Home Subscriber Server (HSS), and in 2G and 3G to the Home Location Register (HLR).
What makes SDM a product category rather than just a database is a split 3GPP introduced in Release 9: separate the stored data from the logic that uses it. That idea is defined in TS 23.335, User Data Convergence, and it is why one repository can sit behind an HLR, an HSS, and a UDM at the same time while an operator migrates.
What follows is the function map (HLR, HSS, UDM, UDR, AUSF), the data each one holds, how the 5G identity model changed with SUCI, and how operators migrate off an HSS without a cutover.
What is Subscriber Data Management?
SDM is the consolidated storage and management layer for subscription data in a telecom core. It holds the permanent record of each subscriber: identities, credentials, service entitlements, and policy attributes. Other network functions query it instead of keeping their own copies.
Before convergence that data was scattered. The HLR held 2G and 3G subscription data, the HSS held 4G and IMS data, an AAA server held Wi-Fi credentials, and provisioning wrote to each of them separately. Launching a service meant touching several databases, and the copies drifted apart.
TS 23.335 addressed this by defining a User Data Repository that holds the data and Application Front Ends that hold the logic, connected over the Ud reference point. The front end speaks whatever protocol an older network expects; the repository owns the single copy. Provisioning writes once.
5G kept that shape and renamed the pieces. The UDM is a front end speaking the 5G service-based interface, and the UDR behind it is the store. TS 23.501 clause 6.2.7 defines the UDM and TS 29.503 defines its Nudm services.
HLR vs HSS vs UDM: the same job, renamed
Engineers moving to 5G usually ask whether the UDM replaces the HSS or sits beside it. In practice it does both, because almost every operator runs several generations at once.
| Generation | Function | What it holds | Main interface |
|---|---|---|---|
| 2G and 3G | HLR (Home Location Register) | IMSI, MSISDN, service entitlements, current VLR or SGSN location | MAP over SS7 |
| 4G and IMS | HSS (Home Subscriber Server) | LTE and IMS subscription data, authentication vectors | Diameter (S6a, Cx) |
| 5G | UDM (Unified Data Management) | Subscription data, credential handling, which AMF and SMF serve the user | Nudm (HTTP/2 and JSON) |
| 5G | UDR (Unified Data Repository) | The stored data itself, shared by UDM, PCF and NEF | Nudr |
| 5G | AUSF (Authentication Server Function) | Runs 5G AKA and EAP-AKA’ authentication | Nausf |
The row that matters during migration is the UDR. Because the repository is shared, a UDM front end can be placed next to an existing HSS front end over the same data, so traffic moves gradually instead of in one cutover.
Benefits of SDM
Integrated view of real-time subscriber data
One repository means one answer. When charging, policy, and the IMS core all read the same record, a subscriber who tops up does not appear barred to one function and active to another while copies reconcile.
Resilience and reliability
Subscriber data is the hardest dependency in the core: if it is unreachable, nobody attaches. These systems are therefore deployed geo-redundantly with active-active sites, so losing a data centre does not stop authentication.
Cost-effectiveness
Consolidation removes duplicate licences and the integration work of provisioning into several databases. The saving operators tend to quote is not storage cost but the time to launch a service, because a new offer is configured once rather than per node.
Facilitates 5G and cloud infrastructure evolution
Because the data layer is decoupled, an operator can introduce 5G standalone by adding a UDM front end rather than rebuilding the subscriber database. The migration path is additive, which is why SDM consolidation usually precedes a 5G core rollout.
Subscriber-centric policy management
Policy decisions need subscriber context. The PCF reads policy attributes from the UDR over Nudr, so a plan’s speed tier, fair-use state, or slice entitlement can be applied at session setup without a separate policy database.
Role of SDM in 5G Core
Subscriber Data Management is central to 5G Core networks. It provides a converged platform for both 4G and 5G services, helping operators enable high-value next-generation use cases.
The 5G core is service-based, and its network functions are meant to be stateless so any instance can serve any request. That only works if the state lives somewhere shared, which is the UDR. SDM is what makes the rest of the core disposable.
It also concentrates the blast radius. Because the AMF, SMF, PCF, and NEF all depend on the same repository, its latency budget and availability target are stricter than those of the functions calling it.
SDM is a cloud-native architecture and supports different deployment options to serve multiple use cases for edge computing and network slicing with CAPEX, OPEX, and the low total cost of ownership (TCO).
SDM offers a flexible solution in 5G Core network architecture, where unified data storage and centralized subscription management services are split. That helps to handle the subscriber data more efficiently and enhances the network responses.
Additionally, the SDM is integral to the Service-Based Architecture (SBA) of the 5G core network. The service-based interfaces in this architecture use HTTP/2 over TCP, enabling efficient communication between network functions.
Types of data held by the subscriber repository
- SIM identities
- Subscription profiles (data, IMS, V2X, and more)
- Contexts, sessions, and policies
- Application states for 4G and 5G subscriptions
- User identities (SUPI/SUCI/IMSI/GPSI for each subscriber in 4G+5G)
- AMF/MME and SMF contexts for UEs
Subscriber identities and why SUCI matters
The identity model changed in 5G, and it is the change most often missed. In 2G through 4G the permanent identity (the IMSI) could travel over the radio link in the clear during attach, which made IMSI catchers possible.
5G replaces it with the SUPI (Subscription Permanent Identifier), which is never sent unprotected. The device transmits a SUCI (Subscription Concealed Identifier), an encrypted form of the SUPI. Only the home network can reverse it, using the Subscription Identifier De-concealing Function (SIDF) inside the UDM.
This places the private key for identity de-concealment in the SDM layer, so the UDM is not merely a database. It is a security function, and its compromise would expose both credentials and subscriber identity.
Components of SDM
Authentication Server Function (AUSF)
The AUSF runs the authentication procedure for 5G. It requests authentication material from the UDM, then executes 5G AKA or EAP-AKA’ against the device. It decides whether authentication succeeded; it does not store the subscription itself.
Unified Data Management (UDM)
The UDM is the 5G front end for subscription data. It generates authentication vectors through the Authentication credential Repository and Processing Function (ARPF), records which AMF and SMF currently serve a subscriber, and answers subscription queries from other functions over Nudm. It is defined in TS 23.501 clause 6.2.7, with its services in TS 29.503. The UDM is stateless in the sense that matters operationally: the data lives in the UDR behind it.
Unified Data Repository (UDR)
The UDR is the store. It holds SIM identities and subscription profiles for 4G and 5G, and it is shared: the UDM, the Policy Control Function, and the Network Exposure Function all read from it over Nudr. TS 29.505 defines how subscription data is represented there. Sharing one repository is what makes a staged migration possible.
Unstructured Data Storage Function (UDSF)
It stores, manages, and retrieves network function sessions in an unstructured format.
SDM Agent Portal
It is a web portal that manages subscriptions, SIM cards, service parameters, and troubleshooting.
SDM Element Management System (EMS)
This component is for managing network element configuration and monitoring system performance and health.
Enterprise Self-Service Portal (ESS)
It is a web portal in private 5G deployments that manages SIM/subscription profiles, device lifecycle, and real-time connection status and monitors usage.
Home Subscriber Server (HSS)
The HSS is the 4G and IMS predecessor of the UDM, reached over Diameter rather than HTTP/2. It is listed here because it does not disappear when 5G arrives: it keeps serving LTE and IMS while the UDM serves 5G standalone, and 3GPP defines how the two stay consistent in TS 23.632 and TS 29.563.
Migrating from HSS to UDM without a cutover
A live network cannot pause while its subscriber database is replaced, so migration is the part of an SDM project that decides whether it succeeds.
The usual sequence is to consolidate first and migrate second. The operator moves HLR and HSS data into a shared UDR while leaving the existing front ends in place, so nothing on the network notices. Only then is a UDM front end added over the same data for 5G standalone traffic.
During that period a subscriber may be reachable through both an HSS and a UDM. 3GPP covers this explicitly: TS 23.632 defines the interworking, and TS 29.563 defines the HSS and UDM interface. Getting it wrong shows up as subscribers who authenticate on 4G but fail on 5G, or whose profile edits apply to one generation only.
The practical constraints are provisioning and rollback. Every upstream system that writes subscriber data has to target the new repository, and operators normally keep the old store synchronised and writable until the new path has run through a full billing cycle.
Who supplies SDM
The market splits into three groups. Ericsson, Nokia, and Huawei supply SDM as part of a full core portfolio and hold most Tier-1 operator deployments. Oracle Communications and Amdocs sell into multi-vendor cores where the operator wants the data layer decoupled from the radio supplier. Challengers including Mavenir, Titan.ium, Alepo, and Summa Networks target smaller operators, MVNOs, and private networks with containerised functions on commodity hardware.
Analyst estimates of market size vary widely by how the category is drawn, so treat any single figure with caution. The demand driver is not disputed: 5G standalone rollouts require a UDM and UDR, and operators still running an HLR carry the cost of every generation at once until they consolidate.
Conclusion
SDM is best understood as one repository with several faces. The data sits in a UDR; the HLR, HSS, and UDM are front ends that present it in whatever dialect a given generation of the network speaks.
That structure, defined by the User Data Convergence work in TS 23.335 and carried into 5G by TS 23.501, is what lets an operator add 5G without rebuilding the subscriber database, and what makes consolidation a prerequisite for a standalone core rather than a cleanup task afterwards.
If you are scoping an SDM project, the questions that decide it are how many provisioning systems write to the data today, whether the UDR can serve every front end you still need, and how long you can afford to keep the old store synchronised before you commit.