Subscriber Data Management and AAA: How They Work Together

Subscriber data management (SDM) is the system of record for who a subscriber is: identity, credentials, entitlements, slice and service profiles. AAA is the system of decision, answering “may this subscriber connect, with what, and for how long” thousands of times per second. Every AAA decision draws on subscriber profile data that SDM owns, and every profile change SDM makes only matters once AAA enforces it. The integration between them determines authentication latency, storm resilience, and how fast a plan change reaches the network. This guide covers the division of labor, the data the two systems share, and the integration patterns that hold up at carrier scale.

Telecom subscriber management covers two jobs that get conflated because they touch the same data. The first is keeping an authoritative record of every subscriber: identities, SIM credentials, service entitlements, quality-of-service profiles, slice assignments. The second is making split-second decisions against that record: authenticate this attach, authorize this session, account for this usage.

Network architects integrating the two ask the same questions in nearly every design review. Which system owns which data? How does the AAA reach the subscriber profile without blowing its latency budget? And what happens to authentication when the data layer is being migrated, or is briefly unreachable?

This article answers those questions, for architects planning subscriber data management, AAA integration across 4G, 5G, fixed broadband, and Wi-Fi. Subscriber data rarely stays in one access type.

What Is Subscriber Data Management?

Subscriber data management is the network’s data layer: the consolidated platform that stores, serves, and provisions subscriber information for every network function that needs it. In a 3GPP architecture, SDM covers a small family of functions that share one converged database.

The UDR (Unified Data Repository) is the storage layer itself. It holds subscription data, policy data, and application data in one repository, replacing the siloed per-function databases that legacy cores accumulated. The UDM (Unified Data Management) is the 5G front-end that serves subscription data and authentication material to the core over service-based interfaces.

The HSS (Home Subscriber Server) is the UDM’s 4G and IMS counterpart, speaking Diameter (S6a, Sh, Cx) to the EPC and IMS. The AUSF (Authentication Server Function) executes 5G-AKA authentication using credentials the UDM serves. A provisioning layer sits alongside them, pushing subscription changes from BSS and CRM systems into the data layer and notifying downstream functions when profiles change.

The practical point for architects: converged SDM platforms combine UDM and HSS on the same subscriber database, so a subscriber’s 4G, 5G, and IMS identities are one record rather than three copies that drift apart. That convergence makes a clean 4G-to-5G migration possible, and it makes SDM the natural system of record for the AAA server to draw on.

How SDM and AAA Work Together

The cleanest way to think about SDM AAA interaction is record versus decision.

SDM owns the truth. When a subscriber is created in the BSS, the provisioning flow writes identity, credentials, and service profile into the SDM layer. When the subscriber upgrades a plan, changes a SIM, or gets assigned to a network slice, SDM is where that change lands first.

AAA enforces the truth at the network edge. A device attaches to Wi-Fi, a home comes online on fiber, a router requests a session from the broadband network gateway (BNG), a network element asks whether an administrator may run a command. In each case the AAA server receives the request, over RADIUS, Diameter, or TACACS+, and must answer in milliseconds. To answer, it needs the subscriber’s profile: valid credentials, service entitlements, bandwidth tier, session limits.

The network element sends an Access-Request to the AAA. The AAA resolves the subscriber identity – a username, a line ID, a certificate subject, or a SIM-derived identity from an Extensible Authentication Protocol (EAP) method such as EAP-SIM or EAP-AKA. It retrieves the subscriber profile, either from its own synchronized profile store or by querying the SDM layer in real time. It evaluates policy against that profile and returns Accept or Reject, with the authorization attributes the network element enforces: VLAN, bandwidth profile, session timeout, and filter ID.

The reverse direction matters just as much. When SDM-side data changes mid-session – a plan upgrade, a suspension for non-payment, a fraud flag – the change must reach live sessions, not just future ones. That is what Change of Authorization (CoA) is for.

The provisioning layer notifies the AAA, and the AAA pushes the new authorization state to the network element without tearing the session down. A subscriber data management AAA integration that only works at login time is half an integration.

Subscriber Profile Data Shared Between SDM and AAA

Not everything in the SDM layer is relevant to the AAA, and not everything the AAA tracks belongs in SDM. The shared surface is the subscriber profile, and being precise about its contents keeps the integration small and fast.

Two design rules fall out of this table. First, the subscriber profile AAA server logic consumes should be a projection of the SDM record, not a hand-maintained copy. Every field the AAA caches must trace to an SDM field with a defined sync mechanism; otherwise the two will disagree, and the disagreement will surface as a subscriber complaint.

Second, session and usage data flow the other way. The AAA is the system of record for what is happening on the network right now, and SDM-side systems should query it rather than duplicate it.

Integration Patterns: Real-Time vs Batch

There are two families of integration pattern in telecom subscriber management, and most production networks run both at once for different data categories.

• Real-time lookup.

The AAA queries the SDM layer inside the authentication path: over Diameter (SWx or Sh for subscriber data), over LDAP against a directory-fronted profile store, or over REST APIs on modern SDM platforms. The AAA holds little or no profile data locally, so every decision reflects the data layer’s current state.

Real-time lookup buys consistency; a suspension takes effect on the very next authentication. It costs latency and coupling: every authentication now includes a backend round trip, and the SDM layer’s availability becomes the AAA’s availability. If you take this path, the SDM query must live in the same latency domain as the AAA front-ends. Measure authentication latency at the 99th percentile with the lookup included, not against a lab-local store.

• Batch synchronization.

Subscriber profiles are provisioned into the AAA’s own profile store ahead of time: bulk loads at migration, then incremental sync driven by provisioning events or scheduled reconciliation. The AAA answers from local, typically in-memory, data.

Batch sync buys speed and storm resilience. Authentication latency stays flat because there is no backend hop, and a reconnect storm – a power restoration re-authenticating an entire neighborhood at once – hits only the AAA, not the data layer behind it. It costs freshness. A profile change is invisible to the AAA until the sync lands, so the sync interval becomes a business decision, not just a technical one.

The hybrid most carrier deployments converge on uses event-driven sync plus real-time escalation. The SDM provisioning layer pushes profile changes to the AAA as they happen, so the local store is seconds behind rather than hours, and the AAA answers from local state, so latency and storm behavior stay flat. Dynamic checks that gate the decision, such as prepaid balance or fraud state, remain real-time queries to the systems that own them. CoA covers the last gap by updating sessions that are already live.

The selection logic: data that changes rarely and is needed on every decision (identity, credentials, QoS tier) belongs in the synchronized local store. Data that changes constantly and gates the decision (balance state) is looked up in real time. Data that changes mid-session (suspensions, upgrades) rides the event stream and CoA.

HSS, UDR, and AAA Integration

In 4G, 5G, and converged cores, the integration has concrete 3GPP interface names, and it pays to be exact about them.

The HSS front-end serves the 4G EPC over S6a and IMS over Cx/Sh. Where the AAA participates in mobile data flows – non-3GPP access such as Wi-Fi offload and Wi-Fi calling – it speaks Diameter to the data layer. SWx retrieves authentication vectors and subscriber data for EAP-SIM/AKA/AKA’ authentication, while SWm and S6b carry the related session flows toward the ePDG and PGW. This is how a subscriber’s Wi-Fi calling session authenticates against the same SIM credentials and profile that their LTE attach uses: one record in the data layer, two access paths through it.

In 5G standalone, primary authentication moves into the core. AUSF and UDM handle 5G-AKA natively, with the UDR behind them. The AAA does not disappear; it moves to the flows 3GPP explicitly reserves for it. Those are secondary authentication toward external data networks during PDU session establishment, network slice-specific authentication (NSSAA), non-3GPP and wireline access, and everything outside the 3GPP perimeter: broadband RADIUS, enterprise TACACS+, public Wi-Fi.

The architectural consequence: in a converged operator, the UDR-centered SDM layer and the AAA jointly cover subscriber authentication across all access types, and they must share subscriber data rather than fragment it. UDM and AUSF authenticate 5G, HSS serves 4G, and the AAA covers fixed, Wi-Fi, and enterprise. A converged SDM platform that exposes the same subscriber record to UDM, HSS, and the AAA’s sync or lookup path is what prevents the per-access-type data silos that make migrations painful and audits worse.

Policy Integration Through AAA-SDM

Authentication says who you are; policy says what you get. The SDM-AAA pair participates in policy from both ends.

On the data side, the SDM layer stores the policy-relevant profile: subscriber categories, usage limits, slice assignments (S-NSSAI), DNN/APN permissions, and QoS parameters such as subscribed AMBR. In 5G, the PCF reads policy data from the same UDR that holds subscription data – one repository serving both the identity and the policy view of the subscriber.

On the enforcement side, the AAA applies policy at session time. For many fixed-line and Wi-Fi services, the AAA’s authorization attributes are the policy: bandwidth profile, session limits, filter rules returned in the Access-Accept. Where a dedicated policy function is deployed, the AAA federates with the PCRF or PCF over Gx, so per-session policy decisions draw on the same subscriber categories and usage limits the SDM layer holds. And when policy state changes mid-session – a quota exhausts, a top-up lands, a slice assignment changes – CoA and re-authorization carry the new decision to the live session.

The integration principle is the same one running through this whole article. Policy data has one home, the SDM/UDR layer, and enforcement points such as AAA, PCF, and PCRF consume it rather than keep private copies. Operators that follow it can launch a new service tier by changing profile templates in one place, instead of reconciling three policy databases every time marketing ships a plan.

Alepo AAA and SDM Integration

Alepo builds both sides of telecom subscriber management – the data layer and the decision layer – designed to work as one stack or to integrate with what you already run.

Alepo SDM is a converged subscriber data management platform: AUSF, UDM combined with HSS, and UDR on a single stack with one converged subscriber database, deployed as cloud-native microservices on Kubernetes. It supports 4G-only, 5G-only, hybrid, and PCF-only deployment modes, so operators can adopt the data layer incrementally, with multi-tenant profile isolation for private 5G and MVNO use cases.

Alepo AAA is an enterprise-class, 3GPP-compliant AAA handling RADIUS, Diameter, and TACACS+ on one platform, with the full EAP family for SIM-based and certificate-based authentication. It integrates with HSS/UDM over standard Diameter (SWx, S6b, Sh), with LDAP and SQL profile stores, and with BSS/CRM systems over REST. That means it fits both real-time lookup and synchronized profile-store patterns, including against third-party SDM layers.

Because both are built to the standard interfaces, operators can start from either end – modernize the AAA against an existing HSS, or deploy the converged SDM layer first – and converge on one subscriber record over time.

Planning an SDM-AAA integration or a data-layer migration? Book a demo – we will walk through your access types, current data layer, and the integration pattern that fits your latency and consistency requirements.

Frequently Asked Questions

Q1. What is the difference between SDM and AAA?

SDM (subscriber data management) is the system of record: it stores subscriber identities, credentials, entitlements, and profiles, and serves them to network functions. AAA (authentication, authorization, accounting) is the decision engine: it authenticates access requests, authorizes sessions, and records usage in real time. AAA decisions consume the profile data SDM owns.

Q2. Does a 5G core still need an AAA server if it has UDM and AUSF?

Yes. UDM and AUSF handle 5G primary authentication, but 3GPP reserves explicit roles for AAA: secondary authentication toward external data networks, network slice-specific authentication (NSSAA), and non-3GPP access such as Wi-Fi. Fixed broadband, public Wi-Fi, and enterprise device administration (TACACS+) also remain AAA-served.

Q3. Should the AAA query the subscriber database in real time or keep a local copy?

Most carrier deployments use both: profile data that changes rarely (identity, credentials, QoS tier) is synchronized into the AAA’s local store for flat latency and storm resilience, while fast-changing state (prepaid balance, fraud flags) is queried in real time. Event-driven provisioning plus Change of Authorization keeps the local store current and updates live sessions.

Q4. What interfaces connect an AAA server to HSS or UDM?

Diameter SWx is the standard interface for retrieving authentication vectors and subscriber data for SIM-based Wi-Fi authentication, with SWm and S6b carrying related non-3GPP session flows. Sh serves application-layer subscriber data queries. Modern SDM platforms also expose REST APIs and support standard Nudr/Nudm service-based interfaces in 5G.