IoT Connectivity Control

Explore seven additional case studies by downloading the full Why Intellegent AAA is the Swiss Army Knife of Telecom paper below. You can also go here to learn more about the Enea AAA Server.

Scaling Secure Connectivity for the SME “Long Tail”

As cybersecurity threats increase, secure cellular IoT connectivity has transitioned from a competitive advantage to a baseline requirement. However, the traditional method of delivering security via Private Access Point Names (APNs) does not scale for the “long tail” of small and medium-sized enterprise (SME) customers.

Limitations of Traditional Private APNs:

• High Operational Costs: Configuring and maintaining unique Private APNs for thousands of SMEs is resource-intensive for the mobile core.
• Manual VPN Provisioning: Establishing Enterprise VPNs between the Packet Gateway and customer networks often takes weeks and consumes significant engineering resources.
• Rigid 1:1 Architecture: Standard Private APNs typically support only one Enterprise VPN. Moving devices to a new VPN requires a complete re-configuration of the APN name on every physical device.
• Localization Risks: When using eSIMs for localization in countries with permanent roaming restrictions, IoT customers often lose control over IP addresses and security policies as the device is handled as part of the local MNO partner’s network.

Furthermore, for the traffic going outside the Private APN directly to the internet, CSP G could previously only offer “blanket” firewall settings across all customers, rather than unique, per-customer security policies.

Multi-tenant Private APN Innovation

To address these challenges, Enea offered its ICCF solution to CSP G leveraging the Enea AAA Server’s built-in Business Logic Engine and IP allocation through RADIUS. This combination enables the Multi-tenant Private APN functionality—an industry-recognized Enea innovation that decouples the APN from the underlying Enterprise VPN.

How it works

The Enea ICCF utilizes advanced IP Address Management (IPAM) and Policy-Based Routing (PBR). Because the Enea AAA is aware of which enterprise a specific IP address belongs to, it can intelligently route traffic to a dedicated Enterprise Firewall function within the ICCF solution.

This allows thousands of independent enterprises to share a single APN while maintaining completely isolated security environments.

End Customer Self-Service Empowerment

Through a web-based self-service GUI provided by CSP G, IoT customers can directly manage their connectivity stack. While SIM management and related functions are handled via APIs to the Aeris CMP, the Enea AAA Server provides the underlying logic for:

• Software-Defined Traffic Routing to any Enterprise VPN destination or directly out to the internet, protected by the customer-unique Enterprise Firewall function.
• Custom Firewall Rules (Allowlists/Denylists and destination blocking).
• Automated Enterprise VPN Setup (reducing provisioning time from weeks to minutes).

Key Comparison: Traditional APN vs. Enea ICCF:

Potential Future Extension for CSP G: The Enea IoT Cloud Gateway Appliance (CGA)

While the current ICCF solution successfully automates the CSP’s side of the VPN connection, the enterprise customer is still responsible for configuring their own network endpoint. To address this final stage of complexity, Enea has developed the IoT Cloud Gateway Appliance (CGA) concept—a strategic innovation designed for hyperscalers such as AWS, Microsoft Azure, and Google Cloud.

This roadmap concept, which has been well received by CSP G and other IoT connectivity customers aligns with the significant trend of enterprise customers migrating their IoT application backends to the cloud. The CGA is designed to facilitate true 100% Zero-Touch Provisioning (ZTP) of Enterprise VPNs by providing a pre-configured, cloud-ready appliance that can be instantly deployed within the customer’s hyperscaler environment.

How the CGA Concept Will Work:

• License Allocation: The CSP provides a CGA license key to the enterprise administrator.
• Instant Deployment: The enterprise installs the CGA in their target cloud environment.
• Automated Activation: Upon startup, the CGA validates the license key via the Enea License Server (1), which then replies with an API URL (2) triggering the Enea AAA Server API to automatically establish the VPN tunnel (3).

By introducing this concept, Enea is demonstrating a clear path toward a fully automated, SD-WAN-like experience for cellular IoT, where the VPN configuration is completely eliminated for the enterprise customer.