Radiator supports EAP-TLS 1.3

One of the most used authentication methods for Radiator users is EAP-TLS. It is widely supported among wireless vendors and the support for EAP-TLS is needed for different certifications for wireless authentication. Radiator has supported different versions of EAP-TLS from the start. As we want to be in the forefront of industry standards, we are happy to announce that Radiator now supports EAP-TLS 1.3 - our team has also been involved in the standardisation work for EAP-TLS and other TLS-based EAP methods.

What is new in EAP-TLS 1.3?

The key feature in EAP-TLS 1.3 is increased privacy and security. Like the RFC document says “TLS 1.3 is in large part a complete remodeling of the TLS handshake protocol including a different message flow, different handshake messages, different key schedule, different cipher suites, different resumption mechanism, different privacy protection, and different record padding.” This new remodeled TLS handshake protocol ensures faster TLS connections as well as patches previous security errors TLS 1.2 had.

Especially important in this new version for EAP-TLS is that no information about the underlying peer identity is disclosed. In other words this means that with EAP-TLS 1.3 the certificate of the user is delivered encrypted. In previous versions of EAP-TLS the client certificate was delivered without encryption, providing a possibility of tracking the users. This has been an issue for some users of EAP-TLS discouraging its deployment. To increase the security of your organization, Radiator configuration allows you to enable EAP-TLS 1.3 for devices that support it, while the earlier versions of EAP-TLS are still available for older devices. Radiator AAA Server Software and its modules are actively developed and updated to support state-of-the-art AAA security features. With the most recent Radiator SIM Pack patch, Radiator now supports IMSI Privacy as well - as one of the few AAA software vendors. So, in short, Radiator is committed to stay in the frontlines of all AAA security features at all times.

Would you like to know more?

While the support for TLS v1.3 in some operating systems varies, the Radiator implementation of TLS v1.3 and EAP-TLS is currently available in the testing branch of Radiator, but will be included in the next stable release as well. If ou are interested please test and give us feedback about the implementation.

If you want to know more about Radiator and EAP-TLS 1.3, please do not hesitate to contact our sales team at info(a)radiatorsoftware.com. For full list of Radiator technical features, you can also visit the Radiator AAA Server Software product page.

Radiator FAQ page out now!

You have asked, and we have answered. In the past years working with Radiator AAA, we have encountered hundreds of interesting questions in support e-mails and calls, RFPs and in other inquiries. We have collected some of the more frequently asked questions onto a FAQ page, which has recently been published. Go check it out at https://faq.radiatorsoftware.com!

What topics are covered?

The FAQ page contains answers to great variety of questions about Radiator AAA Server Software. Currently the FAQ covers our core product, Radiator AAA Server Software. At the first stage, the FAQ page focuses on Radiator AAA Server Software, our core product. We will gradually push updates and expand the FAQ based on feedback and the needs of our audience, to include our modules and general questions about Radiator Software as a company.

What if my question is not in the FAQ?

If you do not find the question that is on your mind on the FAQ page, however, please do not hesitate to contact us via e-mail to info (at) radiatorsoftware.com.

Radiator used for authentication in water monitoring

Water monitoring is important in all regions of the world. In order to have a clear overall picture of such vital resource, it is necessary to have real-time data about river levels and flows, storage elevations and volumes, and water salinity.

Water monitoring organizations use remote sensor networks to monitor data such as reservoir levels, stream flows, and pipeline valve positions. Those sensors, often equipped with mobile data transceivers, are critical components of the water management system, and therefore need to be authenticated.

For one of our major customers in this field, we have provided a RADIUS authentication solution, using Radiator AAA server to authenticate around 2000 active devices currently in active service.

After the authentication is done, the sensors send their telemetry data to specialized data repositories for processing, analysis, and display, in order for customer organizations to know the real-time status of their water system.

Would you like to know more about using Radiator in device authentication?

If you are interested in using Radiator in device authentication - for example in telemetry or sensor networks, please do not hesitate to contact our sales team at sales@radiatorsoftware.com.

Radiator, being the most flexible AAA server in the market, may be just the solution for your authentication use case.

Flexible M2M/IoT service with Radiator and Private APN

M2M (Machine to Machine) communications, IoT (Internet of Things), and Industrial Internet are constantly bringing new connected devices, things, to the Internet. Operators and other companies already use Radiator AAA Server Software to create M2M, IoT, and Industrial Internet services to customers. Using Radiator with Private APN (access point name) is an important use case.

Figure 1: Radiator RADIUS server and Private APN service architecture

Most mobile operators provide, in addition to their own APNs, also a Private APN service for companies interested of separating their data traffic from operators’ generic subscriptions. The Private APN service utilises operator’s SIM cards for radio network access, but separates the data traffic in operator’s GGSN (gateway GPRS support node) by the access point name (e.g. internet.company instead of operator’s own access point name). These separate private access points may have their own parameters for authentication, accounting, IP networks, IP address allocation, connection parameters, traffic accounting, priorities, and other functionalities. Depending on the GGSN capabilities, it is possible to move some of these functionalities and information to a separate RADIUS service, which is provided either by the operator or company utilising the Private APN.

With the Private APN and Radiator AAA Server Software as a RADIUS service, our customers have successfully deployed M2M, IoT, and Industrial Internet solutions. Some examples are:

• Fixed IPv4 and IPv6 address allocation for mobile operator M2M/IoT service based on MSISDN (phone number) with the option of returning any GGSN-supported subscription parameters from RADIUS to GGSN
• Ensuring that the Australian state-wide network of water measurement devices are active and sending measurement data, and working as AAA service for VPN connection authentication for devices
• Tracking truck locations, and authenticating, accounting, and authorising GPS tracking devices for fleet tracking service operating across several operators and European countries

Would you like to know more?

This use case is one of the many, where Radiator can be used to provide additional and complementary functionality to mobile network and Internet of Things/Industrial Internet solutions. Contact our team at sales(a.t.)radiatorsoftware.com to set up a meeting, where we can discuss how Radiator could help you in building and deploying mobile network or IoT/Industrial Internet services and solutions.

SIM Authentication and Charging with Radiator - expand your data coverage with Wifi

In many cases operators and telcos have a need to expand their mobile data coverage with Wi-Fi. In many cases, the main requirements common to many network service providers are:

1. One authentication method need for both Wi-Fi- and LTE-networks. This way the authentication and charging of clients would be easy no matter which network the client uses.
2. Both mobile and laptop users need to have common charging and policy method

In addition to this, common requirement is to provide prepaid data plans for their clients. The clients must not exceed the prepaid plan, no matter which device they use or how they authenticate.

The solution - SIM Authentication, Policy and Charging control with Radiator.

Our solution for our customers behind this is Radiator EAP-AKA - a standard for authenticating wireless LAN access with SIM cards and the existing worldwide 3G/LTE mobile network. Support for EAP-AKA is now included in a number of smart phones, tablets and other devices. In addition to this, laptop users can use the same authentication service with username/password (PEAP) authentication.

In order to provide additional requirement for our customers, how to provide a prepaid data plan for their clients, we used another Radiator server with charging and policy functionality.

One of the perks include novel functionality for the end user when his data quota has been used. End user is not logged off from the network at any time - for example during the session when rest of the data quota is used. However, when end user tries to log on next time after the quota has been used, his network access speed is restricted only to support renewal of data plan.

This solution provides flexibility for data plans of end users - whether you want to provide them access based on data quota, time spent your network, or both.


Examples of different data plans for different customer needs - all can be done with Radiator

How we did it?

During the configuration process, our experts have been working side by side with customers' personnel, to provide support where needed. Together with our customers, mostly telcos, we have been creating solutions in which Wifi- and LTE-networks can be authenticated with single SIM. With this kind of solution, both the Wifi- and LTE-networks use the same data plan. Our expert team is happy to help you in this kind of configuration and integration projects - solutions can be done in various network vendor environments.

Same need in your own network?

The right solution for your needs is Radiator EAP-SIM Pack, Radiator Policy and Charging Support or combination of these two. Please contact our sales team for more info: sales (a.t.) radiatorsoftware.com with your plans.

Radiator EAP-SIM Pack is now known as Radiator SIM Pack.

Radiator Interoperating with Hotel Management Systems

One of the widely seen use cases for Radiator is interoperating with different hotel property management systems (PMS). Radiator is used between the hotel’s PMS and the network equipment that controls internet access in hotel rooms. One of the commonly used systems is Micros Opera that is used by both independent hotels and hotel chains.

For Opera, we have implemented support in Radiator that is easy to deploy with your own team or with the help of our experts. When Radiator starts up, it will receive hotel customer information from Opera. This information is used for Wifi network authentication. The basic information received from Opera is name, room and customer id of the guest. When the hotel guests check in or check out, the information Radiator maintains is updated by Opera. Radiator support is not limited to Opera: it supports any PMS that provides a FIAS interface.

Many hotels require guests to log in with their name and room number. Radiator then gives access based on customer information it has received from Opera. This functionality is shown in the picture below.

In addition to simply offering unpoliced, complimentary internet access, Radiator provides you more advanced options for revenue generating services. Radiator can, for example, give policy instructions, such as the speed given to the customer - based on the price customer is willing to pay for the internet access. Also, Radiator can pass information to network equipment (such as Mikrotik controllers) about how long the customer can use the internet with their current login without having go through the login process again.

Same need in your own hotel or hotel chain?

If you need a smart and flexible internet access service for your business, just contact our sales team at sales@radiatorsoftware.com. Our experts at Radiator Software can provide you with competitive service package suited just for your needs.

Radiator logging features - have a better understanding of your network

A proper logbook keeps the world in order. Photo by vxla.

As networks are the most business critical components of telco and ISP business, it is important to know what is happening on them. For this the network needs AAA and SIEM (Security information and event management) services. The SIEM services are often provided by different vendors with different requirements for message format. For example, some use CEF while the others can accept free format text. We are proud that Radiator already provides interoperability that our customers can rely on. We also welcome your requests for new features.

Radiator 4.14 introduces LogFormatHook that provides a new way to handle logs. The main use of LogFormatHook is to create Radiator logs in different formats such as JSON and CEF. After this the formatted log message can be transmitted to an external log server or SIEM system for further processing, visualisation and archiving. Examples of these servers and systems are Splunk, Elasticsearch and RSA enVision and Security Analytics.

Especially with SIEM systems this functionality provides Radiator users many opportunities for log analysis. The SIEM systems can process log data for forensic analysis, compliance, dashboards and alerting - everything you or your customers need to know about status of their network.

Considering updates to your logging configuration?

If you have a network environment that needs this kind of interoperability with their log or SIEM systems, please contact our sales team at sales (a.t.) radiatorsoftware.com . Also, if you have questions about interoperability concerning Radiator or some other AAA server solution - we just may have a solution for you.

Improving Clustering Support in Radiator with Gossip Protocol

 Our Radiator is deployed in various operating environments, ranging from single server instances to large clusters, sometimes called server farms. Recently, we have developed Radiator support for Gossip protocol framework and Redis based Gossip implementation. The Gossip framework allows clustered Radiator instances to share information and event notifications. The instances can be standalone or part of a Radiator server farm.

One use case for the Gossip framework is co-ordinated detection of unreachable next hop proxies. Multiple Radiator instances can now signal next hop proxy unreachability and reachability information with Gossip messages. The instances may be part of server farm, completely separate processes running on the same or different hosts or any combination of thereof - depending on the customer’s network architecture.

Radiator 1 informs Radiator 2 via Gossip

This allows, for example, one server farm worker to run Status-Server queries when the FarmSize configuration parameter is set. When the member notices that the next hop has become unreachable, it can quickly alert the other members to immediately switch over to an alternate next hop. This provides a method to quickly recover from failures - and also switch back when the failure condition has been resolved.

In general, when the instances can share information, co-operating Radiator instances as a whole can function more efficiently and respond more quickly to configuration and other changes.

As our product development continues, we are planning to develop more clustering functionality to Radiator. Our aim is to provide even more performance to network environment with large amount of end users.

How can I use them as a Radiator customer

If you already use Radiator, see goodies/farmsize.cfg for a configuration example with shared duplicate cache and Gossip and Redis configuration. As our development work continues, more modules will be added and upgraded to use the Gossip framework.

If you are not yet a Radiator customer, please contact our sales team at sales(a)open.com.au with your question about. We are happy to help you with your issues.

Reduce the time to market of your products with Radiator

 

Photo by Egan Snow

Time to market is one of the key issues when you want to provide new services and products to your customers. When competition is though, new ideas should be easy implement in your customer’s operating environment.

One of the strengths of Radiator charging and policy pack is its flexibility in order to test and create new products. As a policy controller, Radiator is often much more flexible than many options on the market.

Flexibility for authentication or database testing

One example of this flexibility are the SIM cards that can be used to create and fully test new products.  In some of our projects, our customers have at first used the dedicated Radiator SIM cards (available freely from us) before switching over to the production environment. Piloting the customer experience for SIM authentication was made as realistic as it gets.

And it doesn't end here: in a similar way telcos or other operators can first test their new services, for example, new data plans, in a safe environment before going live.

Another example where flexibility comes in handy are the different types of databases. Since Radiator Policy charging and rules function (PCRF) and Online charging system (OCS) have been tested against sqlite, MySQL, PostgreSQL and Oracle SQL Database, it is possible for you or your customer to choose from different options that fit best to your needs and existing environments and the data within.

How to speed up your product and service development with Radiator?

Our team has gained experience with Radiator for different use cases over multiple years. We have wide experience of different kind of product solutions. When you are thinking about use cases, such as SIM authentication or policy and charging issues, please do not hesitate to contact our sales team at sales@open.com.au

Radiator Connects - from Machine to Machine to the Internet of Things

Our customer, a telecommunication company, had a pressing need in their network. They needed to replace their outdated Radius solution with a new design that allowed their M2M (Machine-to-Machine) network to function automatically as a integrating solution between the network controlled devices and the operator’s network.

In addition to telcos, the same kind of solution can be provided for power companies, logistical companies and others who have a need for an IoT-solution where devices interact with each other. Devices can be either pre-provisioned in batches (such as contactless electricity meters) or they can be uploaded to the system one device at a time via the user portal operated by the company. The basic functionality is shown below.

 

In this kind of operating environment, it is essential that the Radius server used for authentication and provisioning is compatible with and able to adapt different systems and devices - some dated while back. You may have, for example, a need to use database of some specific vendor (Oracle etc) in the future as well. From Radius server you then need interoperability and flexibility - and Radiator can be easily integrated to your operating environment. 

Same need in your own network?

For this kind of configuration, the right solution for you is Radiator, possibly with Radiator EAP-SIM Pack  - with an IoT-solution it is often convenient to use SIM authentication. To complement Radiator capabilities, our team of Radiator experts, making it easy for you to just deploy Radiator as the solution or the replacement for less flexible system. Please contact our sales team sales@radiatorsoftware.com,  when figuring out the best solution for your needs.

The Radiator EAP-SIM Pack is now known as Radiator SIM Pack.

Preventing Bill Shock with Radiator

Photo by Thomas Fano

Unexpected bill shock - a huge bill accumulated from roaming - can be a nasty surprise for your customers. It is also one that can be avoided, both in domestic and in global use. One of the most known use cases is based on EU roaming regulations.

When your client uses mobile phone in other EU countries to go online, there's a limit on what an operator can charge them. The limit is based on EU regulations. To protect the client against excessive data roaming bills, the monthly cost of downloaded data on mobile device is capped, worldwide, at €50, unless something else has been agreed on. Following the EU regulations, a warning is sent when the usage reaches 80 % of the quota.

In addition to EU regulations, a system for warning and limiting data use is needed for global roaming to ensure that your clients will not have a bill shock from their worldwide data usage.

With Radiator, we have already done these kind of solutions for our operator customers who have in turn provided it for their virtual operators. In this post, we will tell you how to do it.

How to use Radiator to prevent Bill Shock

The basic layout of operator infrastructure

Radiator keeps track on the data used by the customer. To do so, Radiator interacts with the billing system where the data plans and client information is stored.

Customer's SIM is used to lookup information about the customer’s current quota usage, data plan, phone number for SMS alerts and possible other information, such as custom limit for data usage. One data plan is typically used for most of the customers, another for enterprise customers and another for customers of a virtual operator.

The client’s updated quota is then stored in the database. When the quota limit is reached, an automated SMS message is sent to the customer. After each month, the data quota is reset in the database and the usage monitoring will start from the beginning.

Customers are happy when their roaming quota is monitored reliably, and operator does not have to allocate any resources to this task. 

What do you need?

The functionality can be done with Radiator Policy and Charging Support. Contact our sales team at sales (a.t) radiatorsoftware.com.

Welcome to the Radiator AAA Server Cookbook

Radiator RADIUS server has been around since the early days of Internet service providers. It has and is still been developed together with our customers and partners around the world. In fact, during its lifetime, so much additional functionality and protocols have been added to Radiator, that instead of just RADIUS server, we should talk more about Radiator AAA (Authentication, Authorisation and Accounting) server. Our new extension packs, Radiator SIM Pack and Radiator Diameter Pack, extend Radiator far beyond of just RADIUS and TACACS protocol functionality. Radiator runs and scales from small embedded devices like Raspberry Pi to carrier grade network equipment and server platforms including Linux, UNIX(-like) and Windows server platforms. Radiator can be run on actual hardware or virtualised in the cloud, the major design point being that Radiator is flexible, scalable and interoperable for customers and integrators to be used everywhere in the AAA infrastructure.

The challenge in marketing Radiator is that because it can do almost everything, where should and could we start in describing what the Radiator can be used for. In trade fairs it is always possible to ask the visitors what does their organisation do and then select a suitable pitch or angle for that particular segment. Doing the same on a web page or paper brochures would require us to spend more resources to write and polish content instead of actually doing the development and real things with Radiator.

For years Radiator has been delivered with comprehensive collection of configuration examples called goodies. Our customers appreciate this and that is why we get contributions from them both in code, configurations etc. However for new customers or ones looking for solution for their problems, this functionality and applicability of Radiator is hidden knowledge. In this Radiator Cookbook, we aim to bring forward old and proven recipes as well as new and experimental ones to use Radiator for solving various customer challenges. This will not be a high frequency blog, but more like one where  you can search for recipes, solutions and inspiration how to use Radiator and where to find more information about it.

Welcome.

The Radiator Diameter Pack is now known as Radiator Service Provider Pack.