Features & Benefits:
Enables Operators to Offer New Mobile Services Over IP
Juniper Networks SBR SIM Server enables service providers to offer new mobile voice and data services over wireless IP access networks, facilitating roaming and seamless handover between networks by enabling the same
mobile identity on unlicensed wireless networks as on the mobile network. The SBR SIM Server provides an interface for passing subscriber credentials from the IP network to the SIM-based authentication information stored
in the HLR/Authentication Center (AuC) over an SS7- or SIGTRAN-based network. Users gain IP network access based on the successful authentication of SIM credentials passed from their mobile devices against the HLR/AuC.
In this scenario, the SBR SIM Server performs the following functions:
- Provides a bridge between the RADIUS/IP-based public WLAN infrastructure and the SIM-based subscriber management system used in the mobile network infrastructure
- Authenticates SIM-based user credentials over the WLAN RADIUS/IP network against operator HLR/AuC
- Supports authorization against service profiles stored in the HLR, SQL/LDAP databases so that operators can deliver differentiated services to their WLAN customers
- Sends RADIUS accounting streams or CDRs to the operator billing system, integrating the billing with the existing operator infrastructure
- Sets up a secure, encrypted connection over the wireless link, protecting data privacy for the end user
Service Delivery in a UMA, Femtocell or 802.1X Environment
Many GSM and UMTS operators are implementing UMA, Femtocell or 802.1X-based services. This allows them to offer secure hotspot access or leverage their mobile voice and data services into the home,
in both cases leveraging existing roaming relationships. In these environments, SBR SIM Server lets operators authenticate subscribers via EAP-SIM and EAP- Authentication and Key Agreement (AKA),
offering a unified user experience.
EAP-SIM Authentication
The EAP-SIM protocol specifies enhancements to GSM authentication and key agreement which provide message integrity protection along with mutual authentication.
EAP-AKA Authentication
The Third-Generation Partnership Project (3GPP) has specified an improved AKA for use in UMTS networks. EAP-AKA provides greater security though the use
of longer session keys and replay protection.
MA/Femtocell Authentication
In UMA environments, SBR SIM performs all AAA functions, authenticating users to the network, authorizing their connections, and writing RADIUS accounting
and CDRs. It also integrates with existing UMA network controllers (UNC) and security gateways or packet data gateways to ensure compatibility in the network environment.
SBR SIM Server was developed with a modular architecture using both EAP-SIM and EAP-AKA plug-in modules to manage the appropriate authentication requests
from subscribers. These modules support user authentication based on International Mobile Subscriber Identity (IMSI) information or anonymous authentication
based on pseudonym values, as well as re-authentication, so that carriers can regularly replace the encryption keys used over the wireless link to protect
the privacy of user data.
Data Security
In an 802.1X hotspot environment, once a subscriber is granted access to the network, the subscriber’s wireless connection is encrypted using the Wi-Fi
Protected Access™ 2 (WPA2) or WPA protocol, enabling dynamic Advanced Encryption Standard (AES), Temporal Key Integrity Protocol (TKIP) or Wired Equivalent
Privacy (WEP) protocol encryption algorithms, depending on which protocol(s) the subscriber’s 802.1X access client supports. These encryption protocols
protect session data against wireless eavesdropping to maintain data privacy within the hotspot.
Odyssey Access Client
For secure hotspot access, an EAP-SIM or EAP-AKA-compatible 802.1X supplicant is a necessary component of the SBR SIM solution. Juniper Networks Odyssey
Access Client (OAC) is an ideal choice for this key component. To provide a simple user interface and ensure a positive user experience, OAC runs on Microsoft
Windows XP, 2000, 98, Me, Pocket PC 2002, and Windows Mobile 2003/2005. It supports any 802.1X-compatible wireless adapter card for compatibility with the widest
range of user devices. It also supports a wide range of WLAN protocols including EAP-TTLS, EAP-PEAP, EAP-TLS, and Cisco’s EAP-FAST and LEAP, to support any network
and security requirement. In addition, the Juniper Networks Odyssey Access Client supports all popular encryption protocols, including WPA2 and WPA.
Service Delivery in an Open Hotspot Environment
As an interim step to complete deployment of 802.1X-based secure hotspot services, or to more securely handle non-802.1X users, carriers can implement a hybrid approach that
relies on out-of-band delivery of login credentials via the SMS text messaging protocol.
SMS One-Time Password
The one-time password via SMS solution is supported through the SMS authentication plug-in, an optional, license-enabled component of SBR SIM. In this model, a temporary account is created for the subscriber
and the account’s temporary one-time password (OTP) is transmitted securely to the user’s device using SMS. The SMS message may be composed in the language of choice of the subscriber. This solution requires
that subscribers have the following equipment:
- A mobile device capable of receiving SMS messages
- A wireless client, such as a laptop or a PDA with an 802.11 wireless network adapter card
- A browser
This method offers the following advantages:
- It lets carriers offer WLAN access based on information in existing mobile subscriber databases (HLR/AuC)
- It uses a common delivery mechanism that may already be employed in support of other services—that of delivering confirming information to users’ mobile phones
- It minimizes the possibility of fraud by delivering login information to a user’s phone, making it more likely that the owner of the account is the one accessing the network
- It doesn’t require upgrading infrastructure to 802.1X, nor does it require client software on the wireless device
- In the absence of 802.1X-enabled hotspots and/or 802.1X-capable devices, this solution provides a means for GSM subscribers to gain access to secure Wi-Fi networks, still enabling unified billing
Authorization/Service Levels
In addition to authenticating Universal SIM (USIM)-based users to the hotspot and setting up their secure connections, SBR SIM lets carriers authorize subscriber connections according to profile
information provisioned in the HLR, SQL/LDAP databases.
Using information stored in the HLR database, such as bearer service, teleservice, and operator-defined call barring (ODCB), SBR SIM can determine whether the subscriber is authorized for such
access and grant or deny access to the network. It is also possible to utilize further authorization data from an SQL- or LDAP-based user provisioning system.
Accounting Data and Billing Services
SBR SIM supports both RADIUS accounting and CDRs for use in customer billing. The RADIUS accounting information received from access points, access controllers or security gateways is recorded
and has multiple options for use. It can be stored locally, stored in an SQL database, or forwarded by SBR SIM to other billing platforms or mediation systems, thus providing the GSM operator with
a flexible array of billing options.
Additionally, specific pieces of information contained within the RADIUS accounting flow, which are relevant to specific services and their associated billing requirements, can be extracted from
RADIUS accounting streams and included within XML-configurable CDRs, which SBR SIM will transmit directly to the mediation or billing system.
Performance
SBR SIM is a proven solution used in many of today’s top mobile networks and ready to scale to meet the growth of service provider services. Its robust performance makes it capable of handling the
busiest networks by offering several methods for scaling the solution. Authentication and accounting services leverage server resources for processing, thus enabling easy expansion in processing speeds
through additional server resources or additional platforms.
Further solution scaling is achievable by offering flexible options to expand throughput across the telephony network. This can be accomplished by increasing the number of licensed SS7 links or
transitioning to the IP based SIGTRAN protocol.
SIGTRAN Support
The growth of 2.5G and 3G wireless technologies, as well as the convergence of voice with data networks and services, has led to the convergence of signaling, data, and voice networks to an all-IP
backbone. SBR SIM server integrates into this all-IP signaling network by supporting SIGTRAN (SS7 over IP).
SIGTRAN, a working group of the IETF, has defined a protocol for the transport of real-time signaling data over IP networks. The SBR SIM solution supports SS7 messaging over IP (SS7oIP) via SIGTRAN,
a new transport layer which leverages Stream Control Transmission Protocol (SCTP).
|
Features |
Features Description |
|
Proven reliability and
scalability |
- Full-function RADIUS/AAA server manages authentication, authorization, accounting and service delivery on GSM and UMTS networks.
- Reliably handles even the busiest networks.
|
|
Easily integrated into existing
mobile infrastructure |
- Enables operators to tap into new revenue opportunities.
- Gives operators ability to offer IP-based services to customers without upgrading the customer care infrastructure.
- Allows operators to extend services into unlicensed radio networks such as Wi-Fi and Bluetooth.
- Gives operators the ability to authorize customers for specific services based on existing HLR/AuC profiles.
|
|
Works in 802.1X, non-802.1X, UMA/GAN,
and femtocell environments |
- Flexible authentication options permit subscriber authentication via EAP-SIM, EAP-AKA, or one-time password (via SMS).
- Enables operators to leverage existing SIM or SMS infrastructure to facilitate secure subscriber provisioning, authentication, and billing.
- Lays a trusted foundation for UMA voice and data services and Fixed Mobile Convergence based on the IP Multimedia Subsystem (IMS) as RADIUS migrates to DIAMETER.
- Integrates seamlessly into next-generation IP-based signaling networks.
|
Juniper Networks Steel-Belted Radius SIM Server