How the AAA server ensures security in telecom networks

 

Introduction

In 2020, around 22 billion internet of things (IoT) connected devices were in use worldwide, a number that’s expected to reach 50 billion by 2030, according to Statista. As networks become more complex and vast, configuring and controlling access to ensure security in the absence of Authentication, Authorization, and Accounting (AAA) is virtually impossible. Put simply, AAA is one of the gatekeepers of the modern telecommunications network. And while we all know that it is integral to every network today, it deserves more credit than its usually given in ensuring the security of a modern network.

Device use continues to surge as 5G and the IoT ecosystem become more widespread. Plus, operators now offer more granular and contextual plans for different customers, as well as advanced billing and charging plans for an ever-increasing array of services. As the number of devices connected to a network as well as the services available to them proliferate, networks are more susceptible not only to accounting errors but also to security breaches and threats such as identity theft. AAA assumes a significant role in ensuring security for these dynamically changing network needs.

How AAA works

The AAA server does just as its name suggests: it authenticates or validates subscribers and their credentials, verifies what services and QoS each subscriber is authorized to access, and ensures proper accounting so that customers are accurately billed for the services they use.

Authentication

The first step in AAA security is Authentication. It serves as the first line of defense in protecting network resources against fraud and identity theft, employing multimodal authentication methods.

Whenever anyone tries to access the network, the job of the Authentication function is identifying whether they are meant to be granted access, and also ensuring that the user is in fact who they claim to be. It does so by ensuring the user enters valid credentials, such as username, password, biometrics, or any other security measures that have been implemented by the operator. These credentials are stored in the operator’s database, against which the Auth server verifies the input given by the user. This database is constantly updated and monitored by network and system administrators.

If the user’s credentials are valid, they are granted access. Those with fraudulent or erroneous credentials are denied access. All network use of verified users is monitored and logged for future reference.

Authorization

Once authenticated, the next step for the AAA is determining what policies apply to the user. These policies will govern the user’s authorization levels, defining what resources, services, and QoS the user can access.

AAA policies can be defined on a host of parameters, such as the time or day, the user’s location, how often they’ve logged in, how much bandwidth they’ve consumed, fair usage, and so on. These policies can also restrict certain actions, such as retrieving and/or changing passwords.

Accounting

The final step for the AAA server is to take stock of the network resources accessed by the user, such as data consumption and duration of their session.

These usage details serve two purposes. One, they ensure the user is accurately invoiced for their consumption. Another important aspect of accounting is to enable administrators to access audit logs to review how and by whom the network was accessed. This usage data is useful to gain valuable insights into customer behavior, usage patterns, and more. These business intelligence (BI) insights help operators create more contextual offerings and enable them to anticipate network use.

Benefits of AAA security

AAA offers a host of technical benefits for operators in implementing network security:

• AAA forms a multi-layered security barrier to secure, measure, and monitor how the network is accessed and by whom, thwarting malicious attempts by cybercriminals to steal and misuse data.
• As cases of data breaches such as identity theft continue to increase, telecom AAA assumes a vital role in strengthening a telco’s data assets by enabling sound practices in identity and access management.
• With AAA, controlling access does not require a statically configured network, pre-defined connectivity modes, fixed or immovable systems, or even fixed IP addresses by enabling operators to secure the network using more granular techniques such as integrating user directories to provide access to specific groups of users. This dynamic approach is especially relevant given the growing number of devices accessing the network through various means.
• It grants operators more control and flexibility in configuring network access, and also lets operators implement multiple standardized authentication methods.
• It employs several back-up systems to ensure redundancy if one security server is down or there is excessive network congestion.
• A centralized security database grants specific access to each user using their unique credentials, enabling easy and swift access termination for inactive or banned users.

How Alepo AAA can help mitigate network risks

Alepo’s modern and scalable AAA Server enables flexible configuration and control over how network resources are used. It provides failsafe systems to ensure that there are no lapses in security even during network outages.

The NFV- and 5G-compliant AAA overcomes the previous limitations of physical hardware. With its evolved architecture, Alepo’s future-proof virtualized AAA (vAAA) helps operators optimize infrastructural resources and ensure the network remains secure even when traffic increases. (Also read the whitepaper: The Evolution of AAA Infrastructure For NFVi Compliance.)

The stateless AAA stores sessions and application states in a centralized database, distributing the transaction load for faster response times while ensuring high levels of security.

The dual-stack AAA supports RADIUS and Diameter protocols for full convergence, enabling a single system to enable secure access to services across all networks (fixed, wireless, and mobile). This includes modern services such as IoT, WiFi calling and offload, and more.

With five-nines availability, Alepo AAA Server ensures network performance is always high while keeping the network safe from external security threats.

Alepo has regarded AAA as a crucial network function and has been at the forefront of AAA innovation from its inception. Today, Alepo AAA Server is at the heart of operations for some of the largest telcos in the world, with millions of subscribers benefiting from its capabilities. The cutting-edge solution is high-performance, self-healing, open (via REST and API gateway), and highly configurable, serving diverse use cases. Its AAA Transformation enables even large operators to seamlessly replace the core network functionality without impacting existing systems, ensuring transparent integration with other core components such as BSS and CRM.

Originally published on Alepo Blog.