AAA and Network Security for Mobile Access

Abstract

For the road travelers in the United States, especially the parents who take their children in the family car on the long road trips, the letters AAA stand for a peace of mind. They feel that any time their car breaks down, they can call the number for the American Automobile Association and ask for roadside assistance. Even though this book is not about that sort of AAA, the 3 "A"s that we talk about here, when designed properly, can bring the same peace of mind to the network operator and its customers. Authentication, authorization, and accounting are three important blocks used in the construction of a network architecture that helps protect the network operator and its customers from fraud, attacks, inappropriate resource management, and loss of revenue.In this chapter, we describe each of the "A"s in the AAA first as a separate topic, and then as a piece that interacts with the other "A"s in an effort to justify why all the 3 "A"s should be treated by the same framework and servers. At the end of the chapter, we provide a model for a generic AAA architecture. Authentication ConceptsAccording to the dictionary, the word "authentic" refers to something that is not false, or a fake imitation, but is worthy of acceptance as a truth or a fact. From the times of early civilizations, where people have run 26 miles only to deliver a message and then fall over and die, to today, when information can travel across the globe in fractions of a minute with a mouse click, proof of authenticity is the first thing the receiver of a message checks.Authentication consists of two acts: first, the act of providing proof of authenticity for the information that is being delivered or stored, and second, the act of verifying the proof of authenticity for the information that is being received or retrieved. In the early ages, an emperor would use his personal seal on his letters to provide assurance for the authenticity of the letter. The letter could then be carried by any messenger, whose identity was not important. The local lord would recognize the emperor seal and trust authenticity of the letter. He would

Security Mechanisms for a Cooperative Firewall

“…Network security refers to the term AAA (Authentication, Authorization and Accounting) to define the access control architectures. The AAA architectures normally consist of three entities: the user requesting the access, an Access Server at the network edge controlling access to the network and an AAA server that grants or denies the access based on the access credentials provided by the user [25]. The AAA architectures require a standardized protocol between the access server and the user information repository in the AAA server in order to exchange the access control related information.…”

“…The DIAMETER server is responsible for processing the request message, authentication of the user and returning the access parameters necessary for the DIAMETER client to deliver the services. Upon receiving the access request, the DIAMETER server carries the verification process locally and responds with: access denial, access granted with authorization parameters, or throws additional authentication queries to the user requesting the access [25]. Figure 2.6 presents a DIAMETER based access control setup, where the remote client Host-A requests a service in the private network and is being authenticated by the Network Access Server (NAS) and the Diameter Server, using the DIAMETER protocol.…”

Towards a Global AAA Framework for Internet

“…The Diameter protocol was specified in 2003 to address the issues of previous AAA protocols such as TACACS+ or RADIUS 1 [18]. Although it was not designed as a generic AAA protocol, it possesses many of its properties [20], allowing extensions that go beyond the scope of network access such as bootstrapping [14].…”

AAA architectures applied in multi-domain IMS (IP Multimedia Subsystem)

“…IMS [3], [4], [17] is a standardized framework typically used by telecom operators to provide mobile and fixed multimedia services in an all IP environment. In order to Figure 1 Examples of multi-domain services provide authentication, authorization and accounting (AAA) services in IMS networks typically the AAA architecture and framework is used [5], [6]. The main challenge related to the use of the AAA architecture for multi-domain services, which is not previously described in literature, is the fact that the scenario where one user has several accounting relationships for one service that crosses multiple domains is not taken into account.…”