Authentication, Authorization and Accounting Server

Description

The Authentication, Authorization and Accounting Server (AAA-S) is a core network entity introduced in 3GPP Release 19 to support authentication, authorization, and accounting for User Equipment (UE) accessing 5G services through non-3GPP access networks, such as Wi-Fi. It operates in conjunction with the Non-3GPP Interworking Function (N3IWF) to establish secure IPsec tunnels and validate credentials. The AAA-S is not a new function per se; rather, it is an evolution of traditional AAA servers tailored to the 5G Service-Based Architecture (SBA), integrating with the 5G Core (5GC) via the NSSAAF (Network Slice-Specific Authentication and Authorization Function) or directly through the N3IWF.

The AAA-S communicates with the N3IWF using the AAA protocol (e.g., RADIUS or Diameter) over the NWu interface, and with the 5GC via the NSSAAF for slice-specific authentication. When a UE attempts to connect through a non-3GPP access, the N3IWF forwards the authentication request to the AAA-S. The AAA-S then verifies the UE's credentials against its database, possibly interacting with the Unified Data Management (UDM) for subscriber data. Upon successful authentication, it authorizes the UE to access specific services and begins accounting for resource usage. The AAA-S also supports extensible authentication methods such as EAP-AKA' and EAP-TLS, ensuring robust security.

Key components include the authentication engine, authorization policies, and accounting mechanisms. The authentication engine validates credentials using methods like EAP-AKA' for SIM-based devices or EAP-TLS for certificate-based devices. Authorization policies determine the level of network access granted to the UE, including slice-specific permissions. Accounting collects usage data (e.g., data volume, session duration) for billing and charging purposes. The AAA-S may be integrated with the UDM to retrieve subscription data and with the Charging Function (CHF) for accounting records.

In the 5G architecture, the AAA-S plays a critical role in enabling seamless and secure connectivity across heterogeneous access networks. It ensures that only authorized devices can access the network and that their usage is properly metered. This is particularly important for enterprise and IoT deployments where devices may connect via Wi-Fi or other non-cellular technologies. The AAA-S also supports network slicing by allowing slice-specific authentication and authorization, ensuring that UEs can access only the slices they are entitled to.

From a deployment perspective, the AAA-S can be implemented as a standalone entity or integrated with other core network functions. It must support high availability and scalability to handle large numbers of authentication requests. Security considerations include protection against attacks such as credential theft and replay, which are mitigated through strong encryption and authentication protocols. The AAA-S is specified in 3GPP TS 31.105 and TS 31.121, which define the technical requirements for its operation.

Purpose & Motivation

The AAA-S exists to provide a secure and standardized method for authenticating and authorizing UEs accessing 5G networks via non-3GPP access technologies. Traditional cellular networks primarily used SIM-based authentication over licensed spectrum, but with the proliferation of Wi-Fi and other unlicensed access, there was a need to extend core network security mechanisms to these domains. Early attempts to integrate non-3GPP access (e.g., in 4G with ePDG) relied on AAA servers that were not fully integrated with the evolved packet core, leading to fragmented security and management. The AAA-S in 5G addresses these limitations by being a native part of the 5G Service-Based Architecture, enabling seamless authentication and authorization across all access types.

The AAA-S also solves the problem of network slicing security. In 5G, network slices can be tailored for specific services with distinct security requirements. The AAA-S, in conjunction with the NSSAAF, ensures that UEs are authenticated and authorized for each slice they attempt to access. This prevents unauthorized access to sensitive slices and ensures that resources are allocated only to entitled users. Furthermore, the AAA-S provides accounting functions that are essential for charging and billing in a multi-access environment, where usage may span different access technologies.

Historically, AAA servers have been used in fixed and mobile networks for many years, but their integration into 3GPP core networks was limited. The introduction of the AAA-S in Release 19 formalizes its role within the 5G core, providing a clear specification for interoperability. This standardization enables multi-vendor deployments and ensures that security and accounting policies are consistently enforced. As 5G evolves towards Release 20 and beyond, the AAA-S is expected to support additional features such as enhanced authentication for massive IoT and integration with edge computing, further solidifying its role in the 5G security landscape.