Radiator, Entitlement Servers and eSIM provisioning

We recommend viewing this post in our new website's integrated blog section instead.

What is eSIM and which devices support eSIMs?

An eSIM is a standardised, remotely programmable digital circuit in a mobile device. Electronics with built-in eSIMs include phones and tablets, companion devices such as smart watches and other wearables, and also enterprise devices such as cellular-connected PCs, automotives and various IoT devices.

What are Entitlement Servers?

The Entitlement Servers, also known as Entitlement Configuration Servers (ECS), are used to communicate the availability of services such as eSIMs, VoWiFi and Voice-over-Cellular to the client devices. Most importantly, Entitlement Servers provide the applicable entitlement configurations enabling the services on the mobile devices.

How does eSIM provisioning work?

The process of activating an eSIM is called On-device Service Activation (ODSA) and it’s specified by GSMA. To initiate eSIM provisioning, the eSIM capable device requests eSIM entitlement configuration from the mobile operator’s Entitlement Server, which in turn starts EAP-AKA dialog with the 3GPP AAA server to authenticate the subscriber. The process may also include subscription transfer when switching to a new device, or a device check to prevent eSIM activation on stolen or fraudulent devices. When all the steps are successful, the Entitlement Server sends the entitlement configuration to the mobile device.

How Radiator fits in?

Radiator SIM Pack is a flexible 3GPP AAA solution that provides multiple interfaces for the EAP-AKA authentication. With the Entitlement Server, Radiator can use EAP over RADIUS, or EAP over Diameter, such as SWa, SWm, STa and Diameter-EAP applications. For connecting with the operator’s subscriber servers, Radiator supports Diameter SWx, Wx, Cx and S6a/S6d interfaces, SIGTRAN, REST API and other APIs.

This flexibility allows mobile operators to easily introduce eSIM support using their existing HSS or HLR, and also makes Radiator a great solution for MNVOs who rely on the authentication interfaces provided by the parent MNO.

How the authentication works

The above figure shows the eSIM provisioning flow (ODSA) and the various interfaces supported by the Radiator for the EAP-AKA authentication part. If you require yet another method, please contact Radiator team: we can often make it happen.

Radiator offering

Radiator Software provides on-prem software licenses for the Radiator SIM Pack 3GPP AAA solution, and expert services to assist with the customer specific configuration and integration with the other network elements. To learn more about Radiator SIM Pack and to discuss your use case, please contact the Radiator team.

Understanding fixed-line network architecture

As broadband connectivity continues to serve as a backbone of modern digital infrastructure, the mechanisms that enable secure and efficient access are more important than ever. Whether delivered over copper lines (xDSL), high-speed fiber networks (FTTH) or a mixture of both, fixed-line internet services rely on a well-orchestrated authentication and provisioning system to ensure that subscribers are correctly identified, authorized, and serviced.

In this post, we’ll break down the high-level architecture of fixed-line networks and identify the key software components and their responsibilities.

Fixed-Line Authentication: A High-Level View

Both Asymmetric Digital Subscriber Line (xDSL) and Optical fibre networks share a similar back-end architecture when it comes to authentication and user management. While the access technologies differ — xDSL using DSLAMs and FTTH using Optical Line Terminals (OLTs) — the authentication flow typically follows these core stages:

1. User Initiation via CPE

When a user powers on their home router or modem, known as the Customer Premises Equipment (CPE), it initiates a connection to the broadband provider’s access network. The CPE is typically configured to use PPP over Ethernet (PPPoE) or IPoE (IP over Ethernet) with DHCP for session establishment.

2. Access Aggregation

From the CPE, traffic is routed through aggregation devices; digital subscriber line access multiplexers (DSLAM) in xDSL networks and optical line terminals (OLT) in optical fibre networks.

These devices forward traffic to Broadband Network Gateways (BNGs), also known as Broadband Remote Access Servers (BRAS). The BNG is the first IP-level point of access for the user, and is responsible for IP address assignment either with a built-in or external DHCP server.

3. Authentication via AAA server

Once the session request reaches the BNG, it performs user authentication with the AAA server with the RADIUS protocol.

The BNG sends credentials (typically a circuit ID or other unique identifier, which are automatically sent from CPE) to a RADIUS server, which validates the connection and authorises it by setting line parameters from central subscriber database.

4. Provisioning and IP Assignment

Here is where user provisioning comes into play. User provisioning is typically done by the Subscriber Management System (SMS) or more broadly, the OSS/BSS (Operations Support System / Business Support System). This is the software layer responsible for:

• User creation and activation
  
• Service profile assignment (e.g., bandwidth, VLAN tags)
  
• Authentication credential management (integration with subscriber database)
  
• Customer lifecycle management (e.g., suspension, upgrades, disconnection)
  

The OSS/BSS typically interfaces with the subscriber database, where the provisioned user information is stored for authentication and authorisation. Modern systems may use automation platforms like Ansible, NetConf, or TR-069 for zero-touch provisioning of CPE devices, especially in FTTH environments.

Summary of Core Software Components

Component	Role
CPE	Initiates session; endpoint for the user
BNG/BRAS	Handles session control and IP management with DHCP / RADIUS server
RADIUS server	Authenticates and authorizes user sessions against a subscriber database
DHCP server	Assigns IP addresses (can be built-in into BNG)
Subscriber management system (OSS/BSS)	Central provisioning engine for user services, integrates with subscriber database

Looking to deploy a fixed-line network?

Radiator Software offers commercially supported ISP-grade RADIUS servers for all types of fixed-line networks. Whether a greenfield deployment or a migration from existing AAA server setup, Radiator is the product for you.For more details, please e-mail us sales@radiatorsoftware.com

We are pleased to announce the release of Radiator Carrier Module version 1.9. Radiator Carrier Module is the Radiator Diameter server component and provides the basis for all our Diameter extensions. The new 1.9 release includes major fixes and improvements for the Radiator Diameter server.

New usability improvements

• Fix Unix stream server to correctly set socket file number to avoid causing high CPU usage in GBA/BSF.
• Fix and enhance decoding of 3GPP-User-Location-Info and decoding of 3GPP-MS-Timezone. 3GPP-User-Location-Info is no longer decoded in place. The decoded value is instead added as OSC-3GPP-User-Location-Info.
• Fix a memory leak caused by timed out Diameter answers.

A full list of changes can be found in the revision history.

Who should update? 

Radiator Carrier Module 1.9 is recommended for all Radiator deployments with Diameter features enabled. The new release is available for all customers with active support contracts for Radiator Service Provider Pack, Radiator SIM Pack, Radiator Policy and Charging Pack and Radiator GBA/BSF Pack. You can find the Radiator Carrier downloads and repositories at the Radiator downloads page. 

Would you like to know more?

As always, you can contact the Radiator team at info(a)radiatorsoftware.com – we are happy to learn more about your use case and assist you!