CSP C – TIER 1 LATIN AMERICAN MOBILE OPERATOR
Logics Mediation Layer with Policy-based Diameter Routing
CSP C, a leading Tier 1 mobile operator in Latin America, implemented a strategic Wi-Fi offloading initiative. By leveraging third-party Wi-Fi infrastructure—comprising over 35,000 Access Points (APs) in high-traffic locations such as hotels, airports, and shopping malls—CSP C significantly reduced the costs associated with expanding cellular coverage in congested areas.
Explore seven additional case studies by downloading the full Why Intellegent AAA is the Swiss Army Knife of Telecom paper below. You can also go here to learn more about the Enea AAA Server.
Security Gaps and HSS Routing Complexity
The operator’s legacy infrastructure utilized combined 3GPP AAA and HSS nodes (Combo AAA/HSS), which lacked support for encrypted IMSIs, creating a significant security gap. Furthermore, CSP C required a sophisticated, policy-based Diameter routing mechanism to intelligently direct authentication requests for entitled subscribers across ten distinct Combo AAA/HSS nodes.
Enea AAA Server as Logics Mediation Layer
Note: Overcoming Legacy Architectural Constraints
CSP C was burdened by an inflexible legacy 3GPP AAA that was tightly coupled with its integrated HSS function. This “Combo” architecture made a standalone AAA replacement impossible without a simultaneous—and commercially unviable—replacement of the HSS. Because the legacy platform lacked support for the standard SWx interface, the operator faced a significant integration hurdle.
To leverage the Enea AAA Server’s advanced business logic and policy-based routing, CSP C chose a pragmatic architectural adaptation: utilizing the SWm interface between the Enea AAA proxy and the legacy Combo nodes, despite the non-standard nature of this specific signaling path (as SWm typically serves as the interface between the ePDG and the 3GPP AAA). While Enea strictly adheres to 3GPP standards, this deployment demonstrates how intelligent mediation can be used as a “surgical” intervention to modernize service logic in even the most rigid legacy environments.
The Enea AAA Server was deployed as an intelligent AAA Proxy with comprehensive support for encrypted IMSIs. Operating as a logical mediation layer, the system integrates entitlement logic and policy-based Diameter routing via a specialized two-step process:
- A – Entitlement Logic: The Enea AAA Server validates service eligibility through real-time API lookups to CSP C’s Amdocs Prepaid (Matrixx) and Postpaid billing systems.
- B – Policy-Based Diameter Routing: The server intelligently routes authentication requests to the appropriate AAA/HSS node based on subscriber identity.
Adaptive Execution Flow
The execution order of these activities is dynamically determined by the format of the received identity:
- Cleartext or Encrypted IMSI: Entitlement logic is performed first to ensure the subscriber
is authorized before engaging the Combo AAA/HSS nodes. - IMSI Pseudonyms: The process is reversed; the Enea AAA first performs policy-based
Diameter routing to resolve the pseudonym and retrieve the permanent identity from the
Combo AAA/HSS before triggering the entitlement logic.
Service Entitlement Logic
Prepaid Users
The Enea AAA Server leverages a SOAP API to verify account status and balance. Access is granted only if the subscriber has a sufficient balance and is not in a “suspended,” “recovery,” or “canceled” state. Users with insufficient funds are automatically redirected to a captive top-up portal.
Postpaid Users
Utilizing an SQL interface, the Enea AAA Server confirms that the postpaid account is active and in good standing (not suspended or canceled) before granting network access.
Policy-based Diameter Routing
To manage its massive subscriber base, CSP C segments users across 10 separate Combo AAA/HSS nodes. The Enea AAA Server ensures intelligent routing based on the following scenarios:
Scenario 1: IMSI Received (Encrypted or Cleartext)
When the IMSI is available, the Enea AAA Server inspects the 9th digit of the IMSI to determine the destination. Through a dynamic GUI, CSP C administrators can map digits (0–9) to the specific AAA/HSS Destination-Host. To ensure high availability and load distribution, the system supports multiple hosts per digit using a round-robin algorithm.
Scenario 2: IMSI Received as a Pseudonym
If an IMSI pseudonym is used, the 9th-digit routing logic cannot be applied. In this case, the Enea AAA Server follows a prioritized resolution process:
1 – Cache Lookup: The Enea AAA Server queries its local cache to see if the pseudonym has a known mapping to a Destination Combo AAA/HSS host (AAA/HSS). If so, it starts EAP Diameter messaging with the selected AAA/HSS.
2 – Sequential Probing: If no cache entry exists, the Enea AAA sends EAP Diameter Authentication requests to a preconfigured list of AAA/HSS nodes in a specific order.
- The system uses the Auth-Request-Type AVP set to AUTHENTICATE_ONLY (1).
- If an HSS returns DIAMETER_ERROR_USER_UNKNOWN (5001), the Enea AAA automatically tries the next HSS on the list.
3 – Discovery & Authentication: This process continues until the server receives a DIAMETER_MULTI_ROUND_AUTH (1001) response, indicating the correct AAA/HSS has been found. The EAP Diameter messaging then continues with that AAA/HSS until the user has been authenticated.
4 – Caching for Performance and Session Persistence: Once DIAMETER_SUCCESS (2001) is achieved, the Enea AAA caches the mapping of the pseudonym, the real IMSI, and the Destination Combo AAA/HSS.
Performance Note: By default, these mappings are cached for 8 hours. Since this duration is configurable via the Enea GUI, it allows CSP C to balance system performance with the frequency of HSS lookups.
A Strategic Guide to AAA Replacement
Legacy AAA systems are struggling to keep up with increasing data volumes, cloud-native architectures, rising complexity, and ever-increasing operational costs. This white paper gives CSPs practical insights on when and how to modernize their AAA infrastructure – delivering higher performance, greater flexibility, lower TCO, and a future-proof foundation for next-generation services.
Access
Why Intelligent AAA is the Swiss Army Knife of Telecom
The AAA server is no longer a static gatekeeper. It's now a Programmable Core capable of intelligent mediation, multi-generation interworking, and policy-driven orchestration at the network edge. Drawing on 8 Tier 1 operator case studies, this white paper shows how the Enea AAA Server turns operational complexity into scalable, revenue-generating services.
Access
