3GPP Radius

Radius is the authentication and accounting server used in Rel 7. I have been reading a lot about it as my job demands to create a test plan and cases for testing a AAA server. I thought of blogging about it.

Ok, so authentication is important in mobile world. You need to know if the mobile subscriber is allowed to access packet core or not. So how this is done in Rel 7? Here it its.

This feature is explained in 3GPP TS 29.061. So mobile terminal sends out an PDP context activate request to SGSN. SGSN create a PDP context request and send it to GGSN. Now if you look at PDP context request there is and IE called PCO ( Protocol Configuration Options). SGSN creates the request with authentication details put in PCO field and forwards it to GGSN.

PCO contains : Type of authentication protocol, user name and password. (PAP/CHAP)

GGSN before granting the pdp responses creates a radius access request with user name and password in PDP request and sends it to AAA server. AAA server grants or rejects the access. Once AAA sever gives ok, GGSN creates PDP response and sends it to SGSN. GGSN may send Accounting start request to AAA server before sending the PDP response. This is nice, simple and easy way for authentication.

If you have a cisco 7200, a AAA server and SGSN, try creating a network for your selves. What I did in my lab was configured a Cisco 7200 as GGSN. Believe me its very simple. Our tool can act as SGSN. It can send out tens of thousands of PDP context requests. Then I pulled a Free radius server from internet. Wala! I have my network. I configured out tool acting as SGSN to send out PDP requests, Cisco 7200 process the PDP request and sends out radius requests to free radius. Free radius says ok and I have PDP response from router.

So this is how network operators create their network. Now going to Rel 8, I see that PCO is still present in GTP v2. But I am guessing authentication has to be much more stronger since its all IP. We can compare a Rel 8 network to WLAN network, just for understanding the authentication better. So in WLAN we have EAP authentication methods. Now Consider EAP TLS with certificate based security. A laptop in WLAN network has certificate to attach to a particular network. Access points in WLAN are configured to talk to AAA server for authentication. So lets consider that laptops as Mobile subscribers and Access point as the core network. AAA servers remain the same in both. Once a mobile node request access, it uses it certificate to get validated. Core network talks to AAA server to authenticate the mobile node. Just like the way it is done in WLAN. After that data may flow encrypted. I havent read much about this in Rel 8, but will post something in this security section soon.

Comments are welcome.