OmniTWAG Performance Benchmarks
Control-plane authentication and signalling throughput of the Trusted WLAN
Access Gateway.
Test environment
| |
|---|
| CPU | Intel(R) Xeon(R) CPU E5-2667 v3 @ 3.20GHz (16 cores) |
| Runtime | Elixir 1.17.0 / Erlang OTP 27 (JIT) (erts 15.0.1) |
| Measurement | 1 s warmup + 3 s measure + 1 s memory per op |
| Commit | main @ 631cd77 |
Throughput is reported as ips (iterations per second — higher is faster).
Avg and Median are per-call latency in microseconds; the median is the
better estimate of typical steady-state latency. Mem/op is the heap memory
allocated per call.
Full authentication (end-to-end)
The topline figure: each scenario chains the complete per-attach sequence —
EAP Identity decode, authentication-vector handling, the EAP-AKA' key
hierarchy, challenge build, MAC, response decode, and MAC verification — so its
throughput (ips) is complete attaches, i.e. sessions, per second per
core. Local mode computes the authentication vector on-box (Milenage);
STa mode receives it from the HSS over SWx/STa.
| Scenario | Throughput (ips) | Avg (µs) | Median (µs) | Mem/op |
|---|
| Full EAP-AKA' attach — STa mode (vector from HSS) | 17,062 | 58.61 | 53.26 | 7,048 B |
| Full EAP-AKA' attach — local mode (vector computed on-box) | 12,211 | 81.89 | 76.75 | 10,560 B |
Cryptography
Per-authentication cryptographic operations: SIM authentication-vector
generation (Milenage), the EAP-AKA' key hierarchy (CK'/IK', session keys, MAC),
ERP fast re-authentication keys, and the generic 3GPP key-derivation function.
| Operation | Throughput (ips) | Avg (µs) | Median (µs) | Mem/op |
|---|
| EAP-AKA' build Challenge packet (encode) | 206,550 | 4.84 | 1.92 | 456 B |
| WLCP key derivation (EMSK -> WLCP key) | 203,706 | 4.91 | 3.11 | 72 B |
| EAP-AKA' compute MAC (HMAC-SHA-256/16) | 192,032 | 5.21 | 3.77 | 72 B |
| EAP-AKA' derive CK'/IK' | 185,969 | 5.38 | 3.91 | 328 B |
| 3GPP generic KDF (HMAC-SHA-256) | 168,479 | 5.94 | 3.81 | 248 B |
| ERP derive rMSK (per re-auth) | 105,348 | 9.49 | 7.38 | 376 B |
| ERP full fast re-auth (rRK -> rIK -> rMSK) | 65,456 | 15.28 | 13.12 | 520 B |
| Milenage compute_all (RES, CK, IK, AK, MAC-A) | 52,195 | 19.16 | 15.63 | 3,544 B |
| EAP-AKA' derive_keys (MK -> all session keys) | 35,700 | 28.01 | 25.35 | 1,552 B |
| EAP-AKA' full auth crypto (CK'/IK' + all keys) | 26,840 | 37.26 | 31.61 | 1,808 B |
| Operation | What it does |
|---|
| EAP-AKA' build Challenge packet | Encodes the EAP-Request/AKA'-Challenge (AT_RAND, AT_AUTN, AT_KDF, AT_MAC). |
| WLCP key derivation | Derives the WLCP protection key from the EMSK (multi-connection mode). |
| 3GPP generic KDF | HMAC-SHA-256 key-derivation function used across the key hierarchy. |
| EAP-AKA' compute MAC | HMAC-SHA-256 AT_MAC over an EAP packet, truncated to 16 bytes. |
| EAP-AKA' derive CK'/IK' | Transforms CK/IK into CK'/IK' bound to the access-network name. |
| ERP derive rMSK | Per-re-auth session key for EAP Re-authentication (RFC 6696). |
| ERP full fast re-auth | Full rRK → rIK → rMSK derivation chain for a fast re-auth. |
| Milenage compute_all | One AKA authentication vector: RES, CK, IK, AK, MAC-A. |
| EAP-AKA' derive_keys | Expands the master key into K_encr, K_aut, K_re, MSK, EMSK. |
| EAP-AKA' full auth crypto | CK'/IK' derivation plus the full session-key expansion. |
Packet codecs
Signalling-plane encode/decode operations: EAP packet parsing,
WLCP (TS 24.244) message handling for multi-connection mode, and the MPPE
key attribute built on every RADIUS Access-Accept.
| Operation | Throughput (ips) | Avg (µs) | Median (µs) | Mem/op |
|---|
| WLCP decode (PDN Connection Request) | 2,933,539 | 0.34 | 0.27 | 448 B |
| WLCP encode + decode round-trip | 1,217,555 | 0.82 | 0.59 | 608 B |
| WLCP encode (PDN Connection Request) | 1,210,184 | 0.83 | 0.40 | 160 B |
| EAP decode Identity packet | 267,446 | 3.74 | 2.41 | 1,136 B |
| MPPE build VSA (Send-Key, RC4 + MD5) | 89,186 | 11.21 | 7.64 | 1,296 B |
| Operation | What it does |
|---|
| WLCP decode | Parses a WLCP PDN Connection Request from the wire. |
| WLCP encode | Serialises a WLCP PDN Connection Request to the wire. |
| WLCP encode + decode round-trip | Encode then decode of one WLCP message. |
| EAP decode Identity packet | Parses an EAP Identity response (NAI extraction). |
| MPPE build VSA | Builds the MS-MPPE-Send-Key RADIUS VSA (RC4 + MD5) carrying the MSK. |