HSS vs UDM
The HSS is LTE's combined subscriber-data store and authentication vector generator. 5G splits it: UDM holds subscription logic, UDR stores the data, ARPF/AUSF generate authentication vectors. This is the "SBA principle" applied to the subscriber database.
| Attribute | HSS | UDM |
|---|---|---|
| Storage | UDR (separate NF) | HSS internal |
| Logic | UDM | HSS |
| Auth vectors | ARPF (in AUSF) | HSS internal |
| Interfaces | Nudm, Nudr (SBA) | S6a, Cx, Sh (Diameter) |
| Compromise blast radius | Depends on which NF is breached | Full subscriber compromise |
Verdict
Splitting the HSS is only valuable if operators actually deploy UDR, UDM, and ARPF as separate hardened NFs. Many early 5G deployments collapse them into one appliance — losing the compartmentalization benefit while inheriting the SBA attack surface.