The Next-Generation, Post-Quantum Secure IMS Core for Modern Telecommunications.
Warning
DEVELOPMENT SOFTWARE - NOT FOR PRODUCTION USE This implementation is currently under active development and has not been production-hardened. Comprehensive security audits, performance validation, and regulatory compliance testing are required before any production deployment.
While standard IMS solutions from industry incumbents are built on decades-old legacy codebases, Cynan offers a Quantum-Ready, Memory-Safe alternative designed for the future:
- π‘οΈ Quantum-Safe Today: Our mission is to secure the digital future. Cynan implements NIST-standardized Post-Quantum Cryptography (ML-KEM, ML-DSA) natively, ensuring your data remains private and secure against future threats.
- π¦ 100% Memory Safety: Built in Rust with zero
unsafeblocks. This means simplicity and reliability for your engineering teams, eliminating the buffer overflows and data races that plague legacy C++ signaling cores. - π Zero-Trust Architecture: We empower organizations to manage and share data effectively. Every internal signaling jump between modules is signed and validatedβprotecting the people behind the devices.
- β‘ Lightweight Agility: A cloud-native microservice architecture designed for efficiency. Achieve carrier-grade throughput (1000+ CPS) with fewer resources, reducing operational complexity and infrastructure costs.
Cynan IMS Core is designed to be the signaling heart for a wide range of modern telecommunications services:
- Voice over LTE (VoLTE): Seamlessly bridges voice services over 4G/LTE networks using standard 3GPP functional elements.
- Voice over New Radio (VoNR): Full support for 5G voice services through optimized signaling and low-latency transport.
- Voice over WiFi (VoWiFi): Enhances coverage and reliability by facilitating secure calls over non-3GPP access networks.
- Voice over Broadband (VoBB): Flexible voice services delivered over fixed broadband connections for residential and enterprise users.
Cynan implements the full 3GPP IMS architecture, providing seamless control and orchestration for SIP-based multimedia services.
graph TB
subgraph "External Entities"
UE["User Equipment (SIP/TLS)"]
HSS["HSS (PostgreSQL/Diameter)"]
SBC["SBC / Inter-operator peer"]
end
subgraph "Cynan IMS Core"
subgraph "Transport Layers"
UDP["UDP Listener"]
TCP["TCP Listener"]
TLS["PQC-TLS Listener"]
end
subgraph "Signaling Modules"
PCSCF["P-CSCF (Proxy)"]
ICSCF["I-CSCF (Interrogating)"]
SCSCF["S-CSCF (Serving)"]
IBCF["IBCF (Border Control)"]
end
subgraph "Integration Planes"
ARM["Armoricore Bridge (gRPC)"]
DIA["Diameter Interface (Cx/Sh/Rx)"]
SEC["Security Enforcer (IPsec/PQC)"]
AS["AS Integration Manager"]
end
end
UE <-->|"Gm (SIP/PQC-TLS)"| PCSCF
PCSCF <--> ICSCF
ICSCF <--> SCSCF
ICSCF <-->|"Cx/Dx"| HSS
SCSCF <-->|"Cx/Sh"| HSS
SCSCF <-->|"Routing"| IBCF
IBCF <-->|"Interconnect"| SBC
SCSCF <--> AS
SCSCF <--> ARM
SCSCF -.->|"O2 (REST)"| SMO["O-RAN SMO"]
- Zero Trust Architecture: Every interconnect is signed and validated.
- Hybrid PQC-TLS: ML-KEM-768 for quantum-safe key exchange with ECDHE fallback.
- Eagle-Fast Auth: Falcon-512 signatures providing high-throughput SIP authentication.
- Inter-Operator PQC: ML-DSA signatures for IBCF peer validation.
- Async-First: Powered by the Tokio runtime for 1000+ CPS on commodity hardware.
- Memory Safety: 100% Rust memory safety (Zero
unsafeblocks). - Modular Design: Hot-swappable functional modules based on standardized Rust traits.
- Armoricore Bridge: Native gRPC/TLS interface for secure media orchestration.
- IPsec XFRM: Native Linux kernel integration for Gm interface security.
- Diameter Pipeline: Comprehensive Cx, Sh, and Rx interfaces for HSS connectivity.
- O2 Interface: REST API for O-Cloud resource management and SMO orchestration (Discovery, Registration, Alarms).
- CUPS Architecture: Complete Control & User Plane Separation with gRPC-based media control.
- CNF Ready: Fully containerized (Docker/distroless) with specialized Helm charts for Kubernetes deployment.
| Category | Component | Status | Description |
|---|---|---|---|
| Core | Transport Layer | β | UDP, TCP, and PQC-enabled TLS 1.3 listeners. |
| IMS Modules | β | P-CSCF, I-CSCF, S-CSCF, BGCF, MGCF, IBCF, SLF. | |
| Security | PQC primitives | β | NIST Level 3 safety with ML-KEM, ML-DSA, Falcon. |
| IPsec (Gm) | β | Native Linux XFRM integration (RFC 3329). | |
| Integration | Diameter | β | Full Cx, Sh, and Rx interface implementations. |
| Armoricore | β | Secure gRPC bridge for media engine control. | |
| Media Plane | β | RTP Parsing complete; Routing logic active via gRPC bridge. | |
| Infrastructure | Cloud-Native | β | Dockerized (Distroless) & Helm Charts ready. |
| O-RAN O2 | β | O2-IMS REST API for SMO Registration/Discovery. |
Explore our detailed technical artifacts for deep dives into Cynan's internals:
- οΏ½ PQC Architecture - The core theory and implementation of quantum security.
- π’ SBC Connectivity - Guide for integrating external networks and SBCs.
- π Migration Guide - Step-by-step PQC adoption path.
- π οΈ Troubleshooting - Operational guide for common scenarios.
- π Security Audit - Current security evaluations and threat model.
- π Performance Analysis - Algorithm benchmarking and efficiency results.
- π‘οΈ Supply Chain Integrity - Cryptographic manifest and digital watermark verification.
Cynan is engineered for high-performance execution on modern hardware. For carrier-grade production deployments (1000+ CPS), we recommend the following:
- CPU: 2+ Core modern x86_64 or ARM64 (AVX2/AES-NI recommended for high-performance PQC).
- RAM: 4GB Minimum (8GB+ recommended for large subscriber location caches).
- Storage: 10GB Available space (primarily for logs and HSS database).
- Network: 1Gbps Ethernet minimum; 10Gbps recommended for IBCF interconnects.
- Operating System: Linux (Kernel 5.15+ for IPsec) or Kubernetes (for Helm deployment).
- Database: PostgreSQL 15.0+ (HSS/Subscriber storage).
- Dependencies:
docker,helm(for cloud-native) ORlibssl-dev,pkg-config(for bare metal).
- Rust Toolchain: 1.75+
For a professional, automated deployment on Ubuntu, Debian, or RHEL, run our official installation script as root:
chmod +x scripts/install.sh
sudo ./scripts/install.shThis script will:
- Detect your OS and install all required system dependencies.
- Install the Rust toolchain if not present.
- Build the production-optimized
cynanbinary. - Configure
/etc/cynanand/var/log/cynansystem directories. - Install and enable the
cynan.servicein systemd for carrier-grade persistence.
After the installation script completes, perform the following two steps to prepare the system for operation:
Create the database and user as defined in /etc/cynan/cynan.yaml:
# Switch to the postgres user
sudo -u postgres psql
# Create the user and database (adjust names/passwords as needed)
CREATE USER cynan WITH PASSWORD 'change_me';
CREATE DATABASE cynan_hss OWNER cynan;
\q
# Apply migrations
sqlx migrate runPlace your carrier-grade or development certificates in the designated security directory:
- Path:
/etc/cynan/certs/ - Required Files:
core.crtandcore.key(or as specified incynan.yaml).
Once configured, start the Cynan IMS Core:
sudo systemctl start cynan
sudo systemctl status cynanCynan IMS Core is built upon a foundation of high-quality open-source and professional-grade libraries. We gratefully acknowledge the following projects:
- fips203, fips204, fn-dsa: NIST PQC implementations.
- aws-lc-rs: FIPS-validated cryptographic provider.
- rustls: Memory-safe TLS.
- tokio: High-performance async runtime.
- tonic: Robust gRPC stack.
- sqlx: Type-safe database connection pooling.
- rsip: Comprehensive SIP protocol engine.
Copyright Β© 2026 Fastcomcorp, LLC. All rights reserved.
This software is dual-licensed:
| Feature | Community Edition | Commercial Edition |
|---|---|---|
| License | Apache 2.0 | Proprietary |
| Usage | Personal / Educational | Commercial / Production |
| Support | Community-based | Customized Enterprise Support |
| SLA & Uptime | Best-effort | Production SLAs Available |
| Legal | As-is / No Warranty | Full Indemnification |
| Compliance | Community-led | Carrier & Regulatory Assistance |
| Updates | Public Release | Early Access & Priority Fixes |
- Apache License, Version 2.0: For non-commercial, personal, and educational use.
- Commercial License: Required for all commercial use, distribution, or revenue-generating deployment. Each commercial agreement is tailored to provide the specific Enterprise Support, SLAs, and legal protections required for mission-critical telecommunications.
See the LICENSE file for the full legal text. For inquiries regarding customized commercial terms, or to learn how Fastcomcorp can partner with your organization to unlock the power of people-centered technology, contact licensing@fastcomcorp.com.