Juniper Networks Steel-Belted Radius Carrier

Steel-Belted Radius Carrier Overview:

As demand and ubiquity for IP connectivity increases, service providers recognize that they must not only offer a wide range of wired and wireless access services but to efficiently manage and leverage these integrated services, they must also unify their service layer into a single infrastructure capable of handling the volume and complexity of AAA requirements across all access services.

Juniper Networks Steel-Belted Radius Carrier is a comprehensive, scalable, and extensible AAA server that delivers the access control, fine grain service authorization, service delivery, and accounting functionality that is required, along with the performance and reliability needed by wired, wireless, and unified service providers offering integrated access services.

Juniper Networks Steel-Belted Radius Carrier is a high-performance AAA server that enables wireless and fixed line operators to gain control over the way subscribers access their networks. It significantly enhances the security and manageability of any network by centralizing user authentication, delivering the appropriate level of access, and ensuring compliance with security policies. It also has the performance and reliability to scale to any traffic load.

SBR Carrier enables you to provide efficient and secure network access, offer differentiated services, participate in new revenue models, and manage network resources. Whatever type of network access you provide, whether it is wireless or wired, second generation (2G) or third generation (3G), or new wireless network access technologies such as WiMAX or femtocell, SBR Carrier sits at the core of your service delivery and customer care infrastructure—authenticating subscribers to the network, authorizing the appropriate level of service delivery, and reliably delivering accounting data to your billing system.

SBR Carrier can fully adapt to your subscriber management infrastructure. It readily integrates with existing subscriber management systems like LDAP, SQL, Home Location Register (HLR), and public key infrastructure (PKI) data bases, making it easy to deploy in either new or existing networks. This allows you to centrally manage the authentication of all subscribers so that you can deliver the appropriate level of service to each, regardless of the method used to connect to the network. SBR Carrier enables flexible and powerful integration with authentication databases, and can interface with your subscriber management system—however you’ve chosen to organize it—to ensure proper authentication and billing for all subscribers. And, SBR Carrier provides flexibility and highly reliable accounting capabilities, ensuring delivery of all accounting data to your billing systems and other base station subsystem (BSS) operations support systems (OSS) elements, allowing you and your partners to bill for usage-based and premium services.

SBR Carrier also allows you to meet stringent uptime requirements. It includes state-of-the-art reliability features that include load balancing and redundancy across your authentication and accounting systems. It also offers complete scalability and the ability to handle thousands of RADIUS requests per second on suitable hardware, to easily accommodate the busiest of networks.

Juniper Networks SBR Series Steel-Belted Radius Servers have market-proven reliability, having been successfully deployed in more than 120 wired and wireless service provider networks over the last 10 years.

 

Features & Benefits:

Single Comprehensive AAA Server Platform

As wireline and wireless network offerings are unified, service providers can improve performance and achieve higher levels of operational efficiency through the deployment of a single comprehensive AAA server infrastructure that handles all users, regardless of the method they use to access the network or the type of credential required for authentication.

Juniper Networks Steel-Belted Radius Carrier:

• Enables the deployment of a single AAA server infrastructure capable of supporting multiple network access and/or subscriber credential-specific authentication requirements; simplifies RADIUS server and subscriber management database infrastructure deployment; and provides performance and scalability improvements with operational and management efficiencies.
   
• Supports a broad range of wireline and wireless access types that include: wireline—xDSL (Point-to-Point Protocol over Ethernet or PPPoE and Lawful Intercept), fiber to the home (FTTH), dial-up, VPN; and wireless—3GPP (packet data protocol), WiMAX1, UMA/femtocell1, wireless LAN (WLAN) (802.1X). This enables you to consolidate your existing AAA systems onto one common platform to improve operational efficiencies through the elimination of single function/silo AAA infrastructure, duplicate or low performance hardware platforms, and simplified network management.
   
• Provides a single AAA server platform that works not only with Juniper RADIUS-compliant products, but also supports a wide variety of network access equipment from the industry’s leading vendors. This broad multivendor support enables you to deploy a single service layer infrastructure for all access technologies to support both new and legacy access equipment.
   
• Works with most backend authentication databases for instant compatibility with the subscriber management and billing systems you’re using today. SBR Carrier can be configured to authenticate users against one or more existing user credential data stores—a feature which is particularly useful when integrating acquired subscribers or transitioning between legacy and new subscriber management database systems.
   
• Delivers operational and capital expense savings by enabling standardization on a common AAA server platform across all of your wired and wireless networks. SBR Carrier can be installed to manage subscriber access for new networks, and it can be installed in place of or in front of existing AAA server products. Having a common AAA server platform that can be optimized to perform with your custom business logic across all of your networks allows you to simplify your AAA server infrastructure and potentially reduce its footprint in your network, delivering CapEx and OpEx savings.

Broad and Flexible Authentication

SBR Carrier readily supports a wide range of backend LDAP and SQL authentication databases (and optionally HLRs), for ensured compatibility with your existing infrastructure, while providing the flexibility to accommodate new service authentication requirements like WiMAX, and/or acquired legacy requirements over a single infrastructure. With its Java-based scripting environment, you can modify SBR Carrier to support your custom business logic even when heavily customized data schemas and formats are already in place, or to inject your own customized business intelligence onto your network.

SBR Carrier’s flexible subscriber database management (SDM) support allows you to:

• Easily resolve subscriber authentication issues associated with the unification of disparate networks with disparate subscriber management systems. SBR Carrier’s ability to authenticate against multiple backend databases gives you the flexibility to leave existing subscriber management systems in place as you consolidate your authentication service layer. It also provides you with the ability to migrate users from one authentication method to another, or you can cap existing databases that are outdated or becoming unmanageable, while simultaneously bringing a new system online.
   
• Extend new services to subscribers without significant impact to your infrastructure. Some new service offerings may require the consideration of new or additional user credentials or session service level information as an element of the initial authentication or authorization of the user onto the network. With SBR Carrier, the authentication sequence can be adapted to locate information in new fields in existing records or new fields that are located in a completely new database, allowing for maximum flexibility in managing your network access.
   
• SBR Carrier is designed to leverage the existing subscriber management database infrastructure and schemas you already have in place, providing operational expense savings by leveraging your existing investment in the systems you use to run your business.
   
• SBR Carrier fully supports authentication against credentials stored in the industry-leading standard database formats: LDAP, SQL (Native Oracle and Java Database Connectivity-JDBC), and HLR.
   
• Works with any SQL table structure or LDAP schema; no database redesign is likely to be necessary.
   
• Can authenticate against one or more SQL or LDAP databases at the same time, even if they’re from different vendors. This enables you to deploy a single AAA server infrastructure that supports all network access regardless of backend authentication requirements. It also gives you the flexibility to keep legacy subscriber management systems up and running as you move users to new systems.
   
• Runs any LDAP filter or SQL query you specify for the greatest flexibility in retrieving information, enabling you to manage subscriber data that may be spread across multiple subscriber databases, or to extend the authentication sequence to include new fields of information required for new service offerings stored in new or existing databases.
   
• Can retrieve stored RADIUS attributes and profiles from backend databases that can be returned to the network access equipment, often combining data from several locations to build a comprehensive authorization profile before sending it back to the network. SBR Carrier flexibly adapts to your existing BSS environment through various accounting methods. Its optional scripting support allows you to customize the decision making capabilities of the SBR Carrier AAA server, enabling you to inject your own, custom business logic onto your network.
   
• Can load balance authentication requests among multiple SQL or LDAP databases to eliminate the risk of a single point of failure and increase performance on busy networks.
   
• Finally, SBR Carrier can authenticate roaming users via RADIUS proxy requests to RADIUS servers at other sites that have the necessary user credential database to authenticate against.

Advanced RADIUS Proxy Capabilities

SBR Carrier provides advanced RADIUS proxy capabilities required to enable redundancy and support roaming, wholesale services, and managed services.

To reduce the risk of a service interruption and add a layer of redundancy within your network, SBR Carrier can forward or load balance RADIUS proxy requests made to multiple backup target servers within your service layer infrastructure (or alternatively “within your network”).

RADIUS proxy is also essential for supporting roaming services for users, enabling them to get Internet access via other service provider networks when traveling outside of their home service provider’s service area. Radius proxy support enables Wholesale Service Providers to open up their network and provide managed authentication services, or to map their AAA server infrastructure to their customers own SDM infrastructure. This is beneficial to MVNOs who may want to manage and control their subscriber’s identity and authentication credentials within their own SDM systems. Radius Proxy can also be leveraged for the deployment of managed services. It allows the Service Provider delivering the managed service to send service authentication requests to a RADIUS server at the managed service customer site, again letting the end customer manager their own SDM system, while leverage the service provider’s network for client access.

SBR Carrier’s ability to support multiple network access technologies, and its powerful RADIUS proxy support, allows you to consolidate and centralize your RADIUS infrastructure into one AAA server platform

With SBR Carrier, you have several ways of setting up RADIUS proxy users. You can:

• pecify a user name decorator to indicate a proxy target (for example, a user would connect using george@myisp rather than simply george)
   
• Configure proxy based on any attribute or combinations of attributes, or based on scripted logic
   
• Direct incoming proxy requests to a specific authentication or accounting method based on user name decoration, on attribute or a combination of attributes, or based on scripted logic
   
• Provide proxy packet filtering and set up rules that govern how SBR Carrier handles packets that are forwarded to or received from target servers. As an example, packet filters can add information to the packet, possibly from a database, to provide the downstream network with additional information. Or, it can remove attributes from the packets to hide information about your network’s characteristics from the downstream partner. Additionally, when a reply comes back from the downstream partner, attributes can be added or removed in a similar way, making sure that the response is appropriate for your network or the service level you are willing to offer.

These RADIUS proxy capabilities are essential if you are providing roaming services, are part of an Internet service provider (ISP) consortium, or if you already have smaller, special-purpose RADIUS servers in place on your network that you would like to continue using.

SBR Carrier has the ability to detect the health of downstream proxies, often referred to as farm proxies, and can adapt its forwarding mechanism based on the health of these proxies, resulting in your infrastructure delivering the maximum service level and customer satisfaction.

Reliable, Real-Time Accounting

SBR Carrier fully supports RADIUS accounting, seamlessly integrates with your accounting and billing system, and provides complete flexibility for managing your session data. RADIUS accounting log files can easily be exported to spreadsheets, databases, and specialized billing software. You can also log accounting data directly to a single SQL database or specify multiple SQL target servers.

In addition, SBR Carrier can be configured to spool accounting data from distributed RADIUS servers to a central billing system, thereby guaranteeing delivery in the event of a system failure. This feature also eliminates lost accounting records and duplicate entries, removes the need for local data backup and batch processing, and facilitates real-time usage tracking for services such as prepaid Internet access cards.

SBR Carrier’s RADIUS accounting support is especially useful for wholesale service providers who want to assure that accurate accounting and billing information for network services is both captured locally and shared on a real-time basis with their wholesale and/or MVNO customers/partners. SBR Carrier allows for subscriber data and billing information to be separated between multiple organizations. As a wholesale service provider, SBR Carrier enables you to:

• Provide subscriber management and billing as part of your service offering to wholesale and MVNO customers
   
• Optionally, allow wholesale and MVNO customers to use their own subscriber management and billing infrastructure
   
• Separate these elements, where the wholesale/MVNO customer may control billing, while you manage the customer data, or vice-versa

Carrier Grade Quality, Reliability, and Scalability

Juniper Networks SBR Series has a market proven track record with over 10 years of deployments in more than 150 service provider networks around the globe. SBR Carrier allows you to meet stringent uptime requirements with state-of-the-art reliability features, including load balancing and redundancy against your subscriber management database and accounting systems.

When it comes time to roll out new network access technologies in your network, SBR Carrier will be ready, helping you to ease time to market by deploying all new services off of the same AAA server platform, allowing you to leverage prior integration with your custom backend OSS and BSS systems.

It also offers complete scalability and the ability to handle thousands of RADIUS requests per second on suitable hardware, easily accommodating the busiest networks.

Thinking about AAA server consolidation? SBR Carrier’s extensibility will enable you to leverage your initial investment to converge your multiple AAA server technologies onto a single AAA platform. SBR Carrier can be placed in front of existing AAA servers that are in either local or remote central offices. With SBR Carrier, you can merge your existing and acquired AAA Servers and their associated backend infrastructure into a common, state of the art, and redundant backend infrastructure system.

With Juniper’s flexible business models, you can dimension your AAA server solution to the exact needs of your business at the time of deployment, from 50,000 to millions of subscribers. As you realize your business goals of growing your subscriber base, adding new access services, consolidating your backend infrastructure, or acquiring additional networks, SBR Carrier will scale with you, allowing you to increase your subscriber session license numbers only as your network grows.

SBR Carrier delivers proven scalability with support for millions of concurrent subscriber sessions.

Easy Diagnostics with Dynamic Statistics and Reports

SBR Carrier logs all authentication transactions, so you’ll be able to view the entire history of authentication requests and the resulting responses. If your access device supports RADIUS accounting, you’ll also be able to track how long each user stays connected, and even have the security of being able to see exactly who’s connected anywhere, at any time.

What’s more, all of the information you need on AAA activity is at your fingertips. You can dynamically view statistics on authentication, accounting, proxy requests, and more.

Or, view the entire history of authentication requests and the resulting responses, and generate such reports as Current Sessions, Successful/Failed Authentication Requests, Unknown Client Requests, and Invalid Shared Secret Requests. All reports are fully searchable and can be easily exported to spreadsheets or SQL databases.

Simple to Configure and Maintain

SBR Carrier’s XML-based GUI lets you administer the server from any machine, not just the one on which SBR Carrier is installed. Easy configuration of the server settings lets you significantly reduce the amount of time required to bring new devices and users online. Simply cut and paste existing configuration settings for users, RADIUS clients, profiles, and RADIUS proxy targets, and only update specific information required for new settings.

And, you can centrally configure and manage multiple copies of SBR Carrier, using the centralized configuration management (CCM) feature. With CCM, you can configure a “primary” copy of SBR Carrier, and replicate that configuration across all valid registered SBR Carrier replicas—saving you time and reducing the possibility of configuration errors. Configuration data on replicas cannot be modified, except by pushing changes from the master server, preventing unanticipated configuration issues at a local level.

Customers can monitor their SBR Carrier server infrastructure through their existing network management solutions via SNMP. SBR Carrier will report activity and all critical system functions to centralized SNMP management agents in accordance with the IETF RADIUS defined MIBs.

1 Support for WiMAX and UMA/femtocell requires optional WiMAX and SIM modules, respectively.

Architecture and Key Components:

Scalable to Support Wireline and Wireless Services

SBR Carrier is a standards-based AAA server that implements Internet Engineering Task Force (IETF) Third-Generation Partnership Project (3GPP) and WiMAX standards.

SBR Carrier provides a feature rich and highly configurable AAA server platform that scales to meet the rigorous requirements of the largest carrier or service provider. It serves:

• Unified Carriers: SBR Carrier provides access support for both wired and wireless networks, enabling you to consolidate your AAA infrastructure onto a single AAA server platform. SBR Carrier servers can be distributed throughout your network or colocated in two to three redundant sites.
   
• 2G/3G Wireless Operators:: SBR Carrier verifies the credentials of subscribers accessing the mobile services/Internet, assigns IP addresses, manages service delivery, and integrates seamlessly with billing and provisioning systems. This capability is critical for the integration of fixed-mobile convergence (FMC) services like femtocell.
   
• Broadband Providers: SBR Carrier makes it easy to authenticate and deliver the appropriate level of service to each user, and provides routing to offer open or wholesale access or services.
   
• Carriers/Wholesale Service Providers: SBR Carrier can handle the busiest network at a market-leading transaction rate. SBR Carrier provides robust RADIUS proxy support, enabling it to easily provide wholesale services to any customer regardless of network infrastructure.
   
• Wholesale Service Customers and Mobile Virtual Network Operators (MVNOs): With SBR Carrier, you can source capacity from any selection of carriers you choose, to expand your geographic reach and deliver your own branded services. Flexible accounting lets you introduce usage-based premium services.
   
• Managed Services/Outsource Service Providers: SBR Carrier gives you the flexibility to manage all customer data and service delivery requirements centrally, or to leverage RADIUS proxy authentication requests to a RADIUS server at your customer’s site, enabling them to maintain control of their own authentication databases at the lowest support cost to you.

 

Diagram:

Steel-Belted Radius Carrier supports a broad range of network access technologies and subscriber management data stores.

SBR Carrier’s ability to support multiple network access technologies, and its powerful RADIUS proxy support, allows you to consolidate and centralize your RADIUS infrastructure into one AAA server platform. SBR Carrier readily supports consolidation of your backend infrastructure.

 

Product Options:

In addition to the core AAA server functionality provided in SBR Carrier, Juniper offers a number of SBR Carrier optional modules under separate license that enable additional functionality within the product. These modules include JavaScript, which can be used to customize the behavior of the SBR Carrier processing logic so that you can inject your own, custom, business logic onto your network; a WiMAX module, which enables mobile WiMAX-specific functionality; and a SIM authentication module which is used to authenticate users against an HLR based on SIM credentials

Note: Please see Juniper’s website for complete information regarding the following modules for SBR Carrier.

JavaScript:

The SBR Carrier scripting module enables you to fine-tune the behavior of the SBR Carrier and implement custom request processing logic. You can use scripts to configure SBR Carrier to evaluate complex decision logic and manipulate RADIUS requests in ways that cannot be expressed through settings in the standard SBR Carrier initialization files.

SBR Carrier scripts are written in JavaScript, an easy-to-use, industry-standard scripting language with a powerful, object-based syntax. With scripting, you can supplement or override specific functional modules within the SBR Carrier by implementing custom processing logic written in JavaScript. JavaScript APIs allow scripts to perform tasks like the following:

• Manipulate RADIUS request and response attributes that are coming into the server, passing through the server (proxy) and leaving the server
• Select the processing realm for a request
• Query external SQL and LDAP servers
• Print information and debug messages to the server log

WiMAX Module:

SBR Carrier WiMAX module is an extension of SBR Carrier’s mobility access technology. It enables SBR Carrier support for WiMAX, including multiple EAP methods, robust mobile IP session management capabilities, and cryptographic key management. The WiMAX mobility module of SBR Carrier supports the following features:

• Cryptographic key generation, management, and distribution
• EAP-TTLS, EAP-TLS, or EAP-AKA authentication methods
• Home agent assignment
• WiMAX capabilities processing and negotiation
• Access-Request categorization by client type: access services network gateway (ASN-GW), home agent, DHCP server, or other home agent and DHCP server assignment, including Home Connectivity Service Network HCSN and Visited Connectivity Service Network (VCSN) assignment
• Post-paid (offline) accounting, including per-flow accounting messages and continued sessions (Account-Stop/Account-Start pairs)
• Reauthentication (authenticate-only service type) without handover
• Mobility and endeavor, including reauthentication and accounting with handover

SIM Module:

The SBR Carrier optional SIM authentication module enables Global System for Mobile Communications (GSM) and Universal Mobile Telecommunications System (UMTS) service providers to provide wireless data access to subscribers, based on the authentication of their SIM credentials against the existing HLR infrastructure and a leveraging of their existing customer care, roaming, and billing infrastructures.

SBR Carrier SIM module allows service providers to deploy IP-based service access, while leveraging their SS7-based authentication systems. SBR Carrier SIM module leverages your existing HLR, billing interface support, and SS7, or the SIGTRAN networks you already have in place. The SIM authentication module retrieves security information from an HLR to authenticate users or devices that use a provider’s SIM(GSM) or USIM(UMTS) cards. It enables all applications that use the authentication protocols EAP-SIM or EAP-AKA. Among those applications are:

• WiMAX
• Femtocell
• UMA (Unlicensed Mobile Access)/GAN (Generic Access Network)
• I-WLAN
• Secured public hotspot

2 Support for WiMAX and UMA/femtocell requires optional WiMAX and SIM modules, respectively.
3 EAP SIM and EAP-AKA support requires the optional SIM module to be installed.

System Requirements:

Recommended Hardware Configuration

Supported Hardware

• SUN Sparc Machine with two-CPU Ultrasparc IIIi processors or better, running at 1.5 GHz or faster

Operating system

• Solaris 10

Memory

• 2G of RAM

Disk space

• At least 750 Mb of local hard disk space (not NFS), including about 81 Mb of local disk space for SBR Administrator.

Web browser

• Internet Explorer 6.0, 7.0: Windows XP, SP2
• Mozilla Firefox 2.0: Windows XP SP2
• Mozilla 1.7: Solaris 10 with JRE 1.5.0_11

 

SBR Series Software Comparison:

 

 

Documentation:

Download the Juniper Networks Steel-Belted Radius Carrier Datasheet (PDF).