AAA API Exposure Function

AAA-AEF is a session termination and rating engine that converges three different signalling protocols — CAMEL (CAP v1/v2 over SS7), RADIUS and Diameter — onto a single rating interface toward the OCS/CHF. Whether a session originates as a CAMEL IDP from a gsmSCF, a RADIUS Access-Request from a NAS, or a Diameter credit-control request from a PGW, AAA-AEF terminates it, requests a rating decision from the OCS in a common format, and applies the result — credit depletion, no-quota, mid-call failure — consistently regardless of which protocol carried the session.

Features & Benefits

Three session protocols, one rating path

CAP v1/v2, RADIUS and Diameter credit-control sessions all resolve to the same outbound rating request toward the OCS/CHF, aligned with the 3GPP charging data model — so quota and session outcomes look the same to the OCS no matter which network element originated the session.

Consistent quota handling across every protocol

No-quota and credit-depletion detection, and mid-call failure handling, are implemented identically across CAMEL, RADIUS and Diameter sessions — not three separate quota engines with three different behaviors.

MSRN-aware mobile-terminated handling

Mobile-terminated call scenarios that require MSRN allocation are handled as a dedicated code path in the RADIUS session logic, not bolted on as a special case.

Spending limit control,
published through the operator's API framework

Beyond session termination, AAA-AEF exposes spending-limit notifications and publishes that API to the CAPIF Core Function — so a subscriber's real-time spending status can be exposed to an authorized application under the same onboarding and authorization framework as the rest of the exposure function family.

AKA authentication challenge,
for the operator's own trusted access points

AAA-AEF also exposes an EAP-AKA challenge/response API over the Diameter Swx interface toward the HSS — the SIM-based authentication a trusted WLAN AP or ePDG needs to authenticate a subscriber on non-3GPP access. This stays inside the operator's trust boundary rather than being published through CAPIF: it hands out authentication material, not a service result, so it's scoped to the operator's own network elements.

Converge CAMEL, RADIUS and Diameter onto one rating path

Session termination and rating, entirely inside the operator domain

In standalone mode every element is the operator's own, and the whole path sits inside the operator domain.

Deployed between session-originating network elements — a gsmSCF triggering CAMEL, a NAS sending RADIUS, a PGW or IMS/SMSC element sending Diameter — and the operator's own OCS/CHF, AAA-AEF terminates each session, converts it to a rating request and applies the outcome, independent of which protocol the session arrived on.

The same instance also answers EAP-AKA challenge/response calls from the operator's own trusted WLAN AP or ePDG over Swx, entirely within this same operator-domain boundary.

AAA-AEF standalone mode: gsmSCF (CAP v1/v2), NAS (RADIUS), PGW/GGSN and IMS/SMSC (Diameter) all reach AAA-AEF directly, which rates each session with the operator's own OCS/CHF over HTTP; every element sits inside the operator domain.

Expose spending limit control to a 3rd party domain with the CAPIF CF

AAA-AEF CAPIF mode, spending-limit control API with 3rd Party Exposure

AAA-AEF 3rd party exposure mode: an enterprise or AF outside the operator domain reaches AAA-AEF's spending-limit control API through the CAPIF Core Function, which onboards, authorizes and routes the request; session termination from gsmSCF, NAS, PGW/GGSN and IMS/SMSC, and the AKA authentication challenge, continue to run inside the operator domain.

In third party mode the consumer sits outside the operator domain, and the CAPIF Core Function stands on the boundary — onboarding the API invoker, applying the security method and routing authorized requests inward.

Where an operator exposes spending-limit notifications to an enterprise application, AAA-AEF publishes that service API to the CAPIF Core Function, which onboards the API invoker, applies the negotiated security method and routes authorized requests to the exposure function — while session termination, rating and the AKA authentication challenge continue to run entirely inside the operator domain, untouched by the third party path.

Technical specifications

Spending Limit Control (CAPIF-published)

3GPP TS 32.294 style (Nchf-aligned)

AKA Authentication Challenge (internal only)

3GPP TS 29.273 (Swx) / IETF RFC 4187 (EAP-AKA)

Admin / Session Control

Slicce internal (REST)

CAPIF

3GPP TS 29.222

CAP v1/v2 (CAMEL)

gsmSCF/gsmSSF, over TCAP/SCCP/M3UA/SCTP

ETSI/3GPP CAMEL Phase 1/2

TCAP / SCCP

ITU-T Q.771–Q.775 / Q.711–Q.714

M3UA / SCTP

IETF RFC 4666 / RFC 4960

RADIUS

Access, Accounting — NAS

IETF RFC 2865 / RFC 2866

Diameter Credit Control

PGW/GGSN

IETF RFC 4006

Rating Request

Outbound to OCS/CHF

3GPP TS 32.296 / 32.290 / 32.291 style

Architecture

3GPP TS 32.240 series charging data model (no single dedicated architecture document)