External Authentication, Authorization, and Accounting Server

Description

The External AAA Server is a critical component in 3GPP interworking architectures, particularly for providing packet data services to subscribers via non-3GPP access networks. It resides in an external packet data network (PDN) and is responsible for authenticating users, authorizing their access to services, and collecting accounting information. The server communicates with the Packet Data Gateway (PDG) through the Wi reference point, as specified in 3GPP TS 29.161. This reference point defines the protocols and procedures for AAA signaling between the PDG and the external AAA server.

The PDG acts as a gateway between the 3GPP network and external packet data networks, such as WLAN. When a user equipment (UE) attempts to establish a connection through a non-3GPP access network, the PDG initiates an authentication and authorization procedure with the External AAA Server. The server validates the user's credentials, which may be based on SIM-based authentication (e.g., EAP-AKA) or other methods, and returns an authorization decision. Upon successful authentication, the PDG establishes a secure tunnel (e.g., IPsec) to the UE, and the External AAA Server begins accounting for the session, collecting data usage and other metrics.

The architecture supports various deployment scenarios, including roaming and non-roaming cases. In roaming scenarios, the External AAA Server may be located in the home network or a visited network, depending on the business agreements. The Wi reference point ensures interoperability between the PDG and the AAA server, which may be from different vendors. The protocols used over Wi are typically based on Diameter, as defined in 3GPP TS 29.161, which specifies the Diameter application for AAA signaling.

Key functions of the External AAA Server include: authenticating subscribers using credentials stored in the server or obtained from other sources (e.g., HSS), authorizing access to specific services or QoS levels, and accounting for resource usage. The server may also enforce policies, such as time-of-day restrictions or bandwidth limits. The accounting data collected can be used for billing, auditing, and network planning.

The External AAA Server is part of the overall 3GPP interworking architecture, which enables seamless integration of 3GPP and non-3GPP networks. It was introduced in Release 7 as part of the work on interworking with WLAN, and has been maintained in subsequent releases. The term was slightly reworded in Release 11, changing 'External AAA Server' to 'AAA server' in the definition, but the functionality remains the same. The server continues to play a vital role in enabling secure and accountable access to packet data services over non-3GPP access networks.

Purpose & Motivation

The External AAA Server exists to provide a standardized, secure, and scalable mechanism for authenticating and authorizing subscribers who access 3GPP packet data services through non-3GPP access networks, such as WLAN. Before its introduction, interworking between 3GPP and non-3GPP networks lacked a unified AAA framework, leading to proprietary solutions and limited interoperability. The External AAA Server, along with the PDG and the Wi reference point, solves this by defining a clear interface and procedures for AAA signaling, enabling operators to offer seamless services across heterogeneous access technologies.

It also addresses the need for accounting and policy enforcement in interworking scenarios. By centralizing AAA functions in an external server, operators can leverage existing AAA infrastructure and integrate with third-party networks more easily. This is particularly important for roaming, where the visited network needs to authenticate and authorize users based on their home network credentials. The External AAA Server enables such scenarios by allowing the PDG to communicate with the appropriate AAA server, which may be in the home network or a broker network.

Furthermore, the External AAA Server supports the evolution towards all-IP networks and the integration of non-3GPP access as a complement to cellular access. It provides a foundation for services like Wi-Fi calling and seamless offloading, which require robust authentication and authorization. The continued presence of this term in 3GPP specifications underscores its enduring relevance in the era of heterogeneous networks and 5G.