Network Access Identifier

Description

The Network Access Identifier (NAI) is a critical identifier defined in IETF RFC 7542 and adopted by 3GPP for use in access authentication. Its primary format is 'username@realm'. The 'username' part uniquely identifies the user within the context of the specified 'realm'. The 'realm' is a crucial component that denotes the administrative domain responsible for authenticating the user, typically the user's home service provider (e.g., operator.com). This structure is essential for roaming.

During network access, when a user (UE) attempts to connect to a visited network (e.g., while roaming internationally), the UE presents its NAI in the access request. The visited network's access point (e.g., a PDN Gateway in 5G, or a AAA proxy) examines the realm portion of the NAI. Since the realm is not local, the visited network's AAA infrastructure forwards the authentication request, containing the NAI, to the AAA server in the user's home realm. This routing is often done through a hierarchy of proxy AAA servers.

The home AAA server (e.g., HSS/UDM in 3GPP) uses the username part of the NAI to look up the user's subscription profile and authentication credentials. It then engages in an authentication protocol (like EAP-AKA') with the UE. The NAI remains constant throughout this process, ensuring the home network knows exactly which user is being authenticated. In 3GPP systems, the NAI is often derived from the user's International Mobile Subscriber Identity (IMSI) or a subscription permanent identifier (SUPI) in a privacy-preserving way (e.g., creating a pseudonym).

The NAI's role extends beyond initial access. It is used in accounting records (e.g., RADIUS Accounting messages) to correlate usage data with a specific user and their home realm for billing and settlement between roaming partners. It is a carrier-grade identifier designed for scalability and global uniqueness, forming the backbone of interoperable authentication in heterogeneous and roaming-enabled network environments.

Purpose & Motivation

The NAI was created to solve the fundamental problem of uniquely and unambiguously identifying a mobile user in a world of multiple, interconnected network service providers (roaming). Before standardization, different networks used various, often incompatible, formats for user IDs (e.g., simple usernames, MSISDNs), which caused severe problems in routing authentication requests during roaming and made inter-operator accounting complex.

The primary motivation was to enable seamless and secure network access authentication for roaming users. The 'user@realm' structure provides a simple, yet powerful, way to embed routing information (the realm) directly into the user's identity. This allows any visited network to determine, without prior knowledge of the user, where to send the authentication request. It decouples the visited network's authentication infrastructure from the home network's user database.

3GPP adopted the NAI to integrate its core network authentication (using Diameter and later HTTP/2-based protocols) with the broader Internet authentication framework established by the IETF. It addresses the limitations of using only an IMSI or MSISDN, which do not explicitly contain domain routing information and can raise privacy concerns if transmitted in clear text. The NAI format is extensible and supports privacy enhancements like pseudonymous or fast re-authentication identities, making it a versatile and future-proof cornerstone for secure, scalable mobile access.