Intelligent AAA Proxy for Public and Private IoT

Explore seven additional case studies by downloading the full Why Intellegent AAA is the Swiss Army Knife of Telecom paper below. You can also go here to learn more about the Enea AAA Server.

Overcoming Architectural Rigidity

CSP A’s IoT operations are highly complex. While its core Public IoT services utilize the Cisco Jasper Connectivity Management Platform, the operator must also support multiple MVNO partners with varying technical capabilities. These range from MVNOs hosted on CSP A’s Jasper AAA to those maintaining independent, third-party AAA servers.

Key challenges included:

• Signaling Complexity: Traffic must be routed using specific Access Point Names (APNs) , or a combination of RADIUS attributes, often with multiple APNs per MVNO.
• Business Logic Requirements: The operator needed to inject specific Attribute-Value Pairs (AVPs) from both Jasper and MVNO AAA systems into signaling toward the Packet Gateways (PGW/GGSN).
• Integration Costs: Adding unique business logic for every MVNO directly into the Jasper platform was deemed cost-prohibitive and technically inflexible.
• Security: CSP A sought to avoid exposing its internal Jasper platform directly to external third-party networks.

Intelligent AAA Proxy

CSP A deployed the Enea AAA Server as a centralized, intelligent AAA proxy. Positioned between the Packet Gateways and the various AAA destinations, the Enea solution provides a powerful business logic engine that decouples the core IoT platform from external MVNO environments.

The system utilizes the Enea AAA Proxy Package, optimized for high-performance RADIUS proxying. It applies custom logic based on the “realm” of incoming messages, allowing administrators to define, modify, or delete flows by matching a combination of RADIUS Attribute-Value Pairs (AVPs).

Proxy Package Key Capabilities

The deployment is optimized to reduce node requirements while maximizing throughput.

Core features include:

• Flexible Mapping: Advanced proxy-matching from Packet Gateways and to Home AAA servers. Support for proxy-matching that always accept and always reject.
• Intelligent Load Balancing and Signaling Steering: Since each Home AAA destination is configured as a Node Group, signaling can be distributed across one or more server nodes using Round-Robin, Failover, Sticky, or Hashed algorithms. The Hashed method steers signaling to a specific AAA node based on a configurable combination of parameters, such as User ID.
• Server Health Monitoring: Real-time monitoring of external nodes via Server-Status messages with configurable failover thresholds.
• Advanced Signaling Support: Includes Change of Authorization (CoA), Disconnect Messages (DM), and RadSec (RADIUS over TLS) for secure transport.
• Observability: RADIUS Copying for accounting audits and comprehensive SNMP counters for all nodes and policy matches.

Deployment Architecture: Public IoT

Enea AAA Server (Proxy AAA)

The IoT Proxy AAA system is deployed across three independent environments to ensure high availability and geo-redundancy:

• Pre-production: A two-node system for validation.
• Production: Dual-site deployment (Site 1 and Site 2), each featuring a two-node cluster.

CSP A Packet Gateways

The CSP A mobile core utilizes multiple Packet Gateways (PGW/GGSN) to initiate RADIUS requests to the Enea AAA. The Enea AAA then applies sophisticated business logic to determine the appropriate routing destination based on a unique combination of RADIUS attributes within the incoming packets.

Jasper AAA System

The Jasper AAA system, hosted at the CSP A Control Center, receives RADIUS packets from the Enea AAA, executes internal policy rules, and proxies the requests back to the Enea AAA. Because the User-Name attribute remains identical for both the original Packet Gateway request and the returned Jasper request, the Enea AAA uses secondary unique attributes—such as the Source IP Address—to identify the flow. This allows the Enea AAA to apply the correct logic and successfully proxy the requests to the intended MVNO.

MVNO AAA Systems

In Public IoT scenarios, third-party AAA systems located at each MVNO’s data center maintain the primary device account databases. These systems serve as the final authority for authentication and accounting. The Enea AAA acts as the intelligent bridge, proxying all relevant RADIUS signaling to these external systems to complete the session. In a few cases the MVNO has the primary device account database hosted with CSP A (Jasper AAA), and in this case only accounting will be exchanged with the MVNO AAA.

Call Flow for the Public IoT Use Case

The Enea AAA facilitates a multi-step authentication process to ensure both CSP A and the MVNO approve the session:

• Initial Request: The Packet Gateway sends a RADIUS Access-Request to the Enea AAA (1).
• Tier 1 Validation: Enea applies business logic and forwards the request to the Jasper AAA (2).
• Secondary Proxying: Upon Jasper’s approval (3), the Enea AAA initiates a secondary Access-Request to the MVNO’s AAA (4).
• AVP Enrichment: If the MVNO approves (5), Enea AAA aggregates the required AVPs from both Jasper AAA and the MVNO AAA, sending a final Access-Accept to the Packet Gateway (6).
• Fail-Fast Logic: If Jasper initially rejects the request (3), Enea immediately sends a rejection to the Packet Gateway, bypassing the MVNO and saving network resources.
• Accounting Logic: To optimize performance, Enea acknowledges Packet Gateway accounting messages once Jasper confirms receipt (7-10). It then asynchronously forwards accounting data to the MVNO AAA. Note: Since the username remains identical across these legs, Enea uses the Source IP Address as a unique discriminator to apply the correct routing rules for return traffic.

Public IoT Call Flow for MVNO With Accounts in Jasper

CSP A have MVNO partners that utilize the Jasper AAA for holding accounts rather than utilizing their own AAA. Here the call flow is very similar with the exception that RADIUS Access Request messages are not sent to the MVNO AAA.

CSP A – International and Private IoT

In this scenario, the Enea AAA Server leverages the core functionality of the AAA Proxy package to provide high-performance, transparent proxying without the need for additional business logic or AVP additions.
For international IoT connectivity, the Enea AAA manages RADIUS traffic exchange with the Eseye AAA server, while the Nokia Private IoT AAA serves as the destination for Private IoT sessions.

Change of Authorization / Disconnect Message

The Enea AAA supports Change of Authorization (CoA) and Disconnect Messages (DM) initiated by external AAAs. The system intelligently identifies the correct subscriber session by matching the User-Name AVP alongside the Acct-Session-Id, NAS-Identifier, or NAS-IP-Address, ensuring that session termination or profile updates are accurately routed to the originating Packet Gateway.