AAA security in 5G networks: what the AAA protocol actually does

The initials stand for authentication authorization and accounting, and the order is not decorative: each step depends on the one before it. There is no useful sense in which a network can decide what a party is permitted to do before it has established who that party is, and no way to attribute usage to an account that was never identified.

AAA security is the discipline of getting all three right together, and the failures that matter are usually failures of the seam rather than of any single step. A correct authentication feeding a stale authorization decision admits the right party to the wrong thing. Sound decisions with no accounting behind them leave nothing to examine when a question is asked six months later.

The functional description is older than any of the protocols that implement it. RADIUS arrived first and became ubiquitous because it was simple: a client asks a server whether to admit a user, the server answers, and accounting records follow separately. Its constraints followed from the same simplicity: unreliable transport, a small attribute space, a strictly client-server shape with no way for a server to initiate anything.

Diameter was written to address those limits directly, with reliable transport, capability negotiation, peer relationships in both directions and room to define new attributes without exhausting the space. In mobile networks it became the signalling protocol between the core and the subscriber database, and an AAA protocol question in a 4G context is usually a Diameter question.

Both are still deployed, so any real network runs an AAA protocol translation somewhere. That translation is where AAA security tends to be weakest, because a boundary between two protocols is a boundary between two sets of assumptions about what an attribute means.

The 5G core is built as a set of network functions that call one another over web protocols instead of point-to-point signalling links. Authentication is concentrated in a dedicated function that works with the subscriber data store to run the procedure and derive the keys the rest of the session depends on. Authorization becomes a question about which function may invoke which service, mediated through tokens instead of assumed from topology, and usage reporting flows to a charging function built for the purpose.

The change is more than a relabelling of authentication authorization and accounting. In earlier generations a great deal was implied by position: a message arriving on a particular interface came from a particular kind of node, because nothing else could reach that interface. In 5G networks any function can in principle address any other, so what was once implied has to be stated and checked, and AAA security stops being a perimeter property.

AAA authentication in a mobile network has an unusual property: the credential is not a secret the subscriber knows but a key held on a card, and the subscriber never handles it. This makes the procedure strong against the failures that dominate password systems, and it moves the whole risk onto identity handling, which is where the enabler work concentrated.

The same credential is used well outside the cellular link. Operator-run WiFi services authenticate against the card instead of a password, which is convenient, and which is why an identity exposure in that exchange is a mobile network problem and not a WiFi one. AAA authentication is the mechanism that ties the two together, and it explains why the identity concealment introduced in 5G matters beyond the radio interface.

Identity exposure over operator WiFi