Authentication for Network Access

The previous lesson measured a principal accessing a service and counted the flow’s six steps. All of the steps assumed the client was already connected to the network: a ticket request has to go from somewhere to somewhere. On enterprise networks, that connection itself is also a decision point. When a cable is plugged in or a device wants to join the wireless network, the edge switch or access point does not verify identity itself — it asks a central service and opens the connection point based on the answer.

This lesson measures that service in terms of access decisions. How many devices ask a single service, how many items must be correct at the same time for the decision to be made, which fallback behavior is chosen when the service is unreachable, and how many paths each of those behaviors opens. The secret between the client and the network was measured in the Network Security course; what is measured here is the leg between the device and the service.

The Service That Makes the Decision

EI8: the device at the access layer does not verify identity itself; it asks a central network authentication service for the decision. The shared secret between the device and the service is the trust root of every access decision that device makes. EI9: when the service is unreachable, the device picks a fallback behavior; the behavior chosen determines both the number of paths opened and the legitimate access stopped, and not having picked one does not mean there is no behavior — the default is a choice too. EI10: the number of opened paths alone is not a ranking criterion; the same number of paths gives two different outcomes depending on how many systems are reached.

This service’s open specification is known by the name RADIUS, and the decision itself has two parts: the device’s right to ask and the identity of the end. The first rests on the shared secret, the second on the credential the end presents. The service asks somewhere else to verify the second — the central directory measured in the previous lessons.

Eighty Devices, One Service

The inventory below is a model: the access layer of the fictional regional measurement network. There is no real organization, real device, or real secret.

// netaccess/access.mjs — the fictional regional measurement network's access-layer devices
// connecting to the central network authentication service (model): there is no real
// organization, real device, or real secret. No randomness.

// EI8: the device at the access layer does not verify identity itself; it asks a central network
// authentication service for the decision and opens the connection point based on the answer. The
// shared secret between the service and the device is the trust root of every access decision that device makes.
// Columns: count = number of devices, point = connection points that must authenticate,
// end = currently connected legitimate ends, revoked = ends whose access was revoked recently.
export const DEVICE = `
  central-edge-switch          switch     6   144   131    4
  central-wireless-ap          wireless  12   240   186    9
  branch-edge-switch           switch    18   216   174    7
  branch-wireless-ap           wireless  24   360   212   11
  field-remote-access-endpoint remote     3   120    96    6
  warehouse-edge-switch        switch     5    60    41    2
  meter-collection-switch      switch     4    48    44    1
  guest-wireless-ap            wireless   8   160    73    3`
  .trim().split("\n").map((r) => {
    const p = r.trim().split(/\s+/);
    return { name: p[0], type: p[1], count: +p[2], point: +p[3], end: +p[4], revoked: +p[5] };
  });

// EI9: when the service is unreachable the device picks a fallback behavior; the behavior
// chosen determines both the opened path count and the stopped legitimate access. The "reach"
// column is how many systems the fallen-back connection can reach (of the org's 16 systems).
export const FALLBACK = {
  "closed":           { new: (a) => 0,       revoked: (a) => 0,       stopped: (a) => a.end, reach: 0 },
  "open":             { new: (a) => a.point, revoked: (a) => a.revoked, stopped: (a) => 0,    reach: 16 },
  "critical-segment": { new: (a) => a.point, revoked: (a) => a.revoked, stopped: (a) => 0,    reach: 2 },
  "cache":            { new: (a) => 0,       revoked: (a) => a.revoked, stopped: (a) => 0,    reach: 16 },
};

// EI10: the chain from the root to the decision is the items that must be correct at the same time, per device.
export const CHAIN = ["shared secret", "service certificate", "end credential",
  "service's directory link", "policy record", "segment mapping"];

// netaccess/tally.mjs — how many devices ask a single service, how many items the chain is, which
// fallback behavior opens how many paths when the service is unreachable, and what renewal costs if the shared secret is compromised.
import { DEVICE, FALLBACK, CHAIN } from "./access.mjs";

const print = (g, ...s) => console.log(s.map((v, i) =>
  (g[i] < 0 ? String(v).padEnd(-g[i]) : String(v).padStart(g[i]))).join(""));
const total = (f, s = DEVICE) => s.reduce((a, x) => a + f(x), 0);
const mode = Object.keys(FALLBACK);
const count = total((a) => a.count);

console.log(`${count} devices ask a single service, ${total((a) => a.point)} connection points, ` +
  `${total((a) => a.end)} connected ends, ${total((a) => a.revoked)} revoked ends`);
console.log(`chain ${CHAIN.length} items, per device; ${count * CHAIN.length} items in the domain`);

const A = [-10, 8, 8, 8, 9, 8];
console.log("\n1. load by device type");
print(A, "type", "devices", "points", "ends", "revoked", "items");
for (const t of ["switch", "wireless", "remote"]) {
  const s = DEVICE.filter((a) => a.type === t);
  print(A, t, total((a) => a.count, s), total((a) => a.point, s), total((a) => a.end, s),
    total((a) => a.revoked, s), total((a) => a.count, s) * CHAIN.length);
}

const B = [-18, 10, 15, 14, 9];
console.log("\n2. same network, four fallback modes, service unreachable");
print(B, "mode", "new paths", "revoked paths", "stopped ends", "reach");
for (const m of mode) {
  const g = FALLBACK[m];
  print(B, m, total(g.new), total(g.revoked), total(g.stopped), `${g.reach}/16`);
}

const C = [-30, -18, 10, 15, 14];
console.log("\n3. today's mode mix across devices, with outcome");
const choice = { "central-edge-switch": "closed", "central-wireless-ap": "cache",
  "branch-edge-switch": "critical-segment", "branch-wireless-ap": "cache",
  "field-remote-access-endpoint": "closed", "warehouse-edge-switch": "open",
  "meter-collection-switch": "closed", "guest-wireless-ap": "open" };
print(C, "device", "mode", "new paths", "revoked paths", "stopped ends");
let y = 0, r = 0, d = 0;
for (const a of DEVICE) {
  const g = FALLBACK[choice[a.name]];
  y += g.new(a); r += g.revoked(a); d += g.stopped(a);
  print(C, a.name, choice[a.name], g.new(a), g.revoked(a), g.stopped(a));
}
print(C, "total", "-", y, r, d);

const D = [-34, 8, 10, 22];
console.log("\n4. what drops if the shared secret is compromised, and renewal");
print(D, "item", "count", "dropped", "renewal");
const row = [
  ["a single device's secret", 1, 1, "1 device manually"],
  ["devices sharing the same secret", count, count, `${count} devices manually`],
  ["affected points", total((a) => a.point), total((a) => a.point), "automatically"],
  ["service certificate", 1, count, `${count} devices manually`],
  ["end credentials", total((a) => a.end), 0, "unaffected"],
];
for (const s of row) print(D, ...s);
console.log(`manual items if the secret is identical across all devices ${count}, if separate 1`);

80 devices ask a single service, 1348 connection points, 957 connected ends, 43 revoked ends
chain 6 items, per device; 480 items in the domain

1. load by device type
type       devices  points    ends  revoked   items
switch          33     468     390       14     198
wireless        44     760     471       23     264
remote           3     120      96        6      18

2. same network, four fallback modes, service unreachable
mode               new paths  revoked paths  stopped ends    reach
closed                     0              0           957     0/16
open                    1348             43             0    16/16
critical-segment        1348             43             0     2/16
cache                      0             43             0    16/16

3. today's mode mix across devices, with outcome
device                        mode               new paths  revoked paths  stopped ends
central-edge-switch           closed                     0              0           131
central-wireless-ap           cache                      0              9             0
branch-edge-switch            critical-segment         216              7             0
branch-wireless-ap            cache                      0             11             0
field-remote-access-endpoint  closed                     0              0            96
warehouse-edge-switch         open                      60              2             0
meter-collection-switch       closed                     0              0            44
guest-wireless-ap             open                     160              3             0
total                         -                        436             32           271

4. what drops if the shared secret is compromised, and renewal
item                                 count   dropped               renewal
a single device's secret                 1         1     1 device manually
devices sharing the same secret         80        80   80 devices manually
affected points                       1348      1348         automatically
service certificate                      1        80   80 devices manually
end credentials                        957         0            unaffected
manual items if the secret is identical across all devices 80, if separate 1

The numbers are of the measurement class; their inputs are EI8–EI10 and the device inventory.

Chain and Load

The header line gives the size of the dependency: 80 devices ask a single service, 1348 connection points depend on that answer, and there are 957 currently connected ends. For the decision to be made, six items per device must be correct at the same time — the shared secret, the service’s certificate, the end’s credential, the service’s directory link, the policy record, and the segment mapping. None of the total 480 items in the domain holds on its own.

The fourth of these six items is a chained dependency and ties the previous two lessons in here. The service does not know the end’s identity itself; it asks the central directory. That is, behind the decision between a cable being plugged in and a port being opened stand two roots: the secret between the device and the service, and the link between the service and the directory. The first is this lesson’s subject, the second was measured in the first lesson, where the number of systems stalling during the directory outage was 13; this lesson adds 1348 connection points to that list.

The load is not evenly distributed. Wireless devices carry more than half the device count with 44, and 56% of the connection points with 760 points. The remote access endpoint is only three devices but holds 120 points and 96 ends; the number of points per device is 40, and this is the densest item on the list. A single device’s misconfiguration produces a result proportional not to the device count, but to the number of points it carries.

Four Behaviors When the Service Is Unreachable

The second table runs the same network through four fallback behaviors. In the closed behavior, no unverified device can get in — new paths zero, revoked paths zero — but 957 ends stop. This row is the safest and most expensive choice on the list; an authentication service’s outage turns into the whole network’s outage.

The open behavior is the exact opposite: no legitimate end stops, but all 1348 points open to an unverified device, and the opened connection reaches 16 of 16 systems. The critical-segment behavior opens the same 1348 paths; the difference is that the opened connection reaches only two of the 16 systems. This is EI10’s measure: the two rows’ path counts are identical, their outcomes are not. A measurement that writes path counting without a reach column cannot tell these two rows apart.

The cache behavior looks better than both at first glance: new paths zero, stopped ends zero. Its cost is in the third column — 43 ends whose access was revoked keep entering the network. This is the third appearance of the same pattern counted as the cache window in the first lesson and the ticket lifetime in the second lesson. Caching a decision delays the decision’s revocation by the caching duration; the mechanism changes, the number lands in the same place.

Today’s Mix

The third table shows the behavior is not chosen uniformly across the network. Of the eight device clusters, four are set to closed, two to cache, one to critical segment, one to open. In total 436 new paths stay open, 32 revoked paths pass through, and 271 ends stop.

The number 436 cannot be read on its own. 216 of it comes from the branch switches assigned to critical segment, and those paths reach two systems; the remaining 220 come from the two device clusters set to open, and they reach all 16 systems. When multiplied by reach, the gap opens up: while the path counts are almost equal, 216 of critical segment reaches only two systems, while 220 of open reaches all sixteen. Leaving the guest wireless access points open can be a reasonable decision, but its reasonableness rests on being bound to a separate segment, and as long as that segment is not written in the table, the decision’s correctness cannot be measured.

The 271 stopped ends do not come from one place either: 131 from central switches, 96 from the remote access endpoint, 44 from the meter collection switch. The remote access endpoint being set to closed behavior means all 96 field ends going connection-less during a service outage. A fallback behavior looks like a security setting; in reality it is part of the outage plan.

What a Second Service Changes

The entire fallback table rests on a single assumption: the service is unreachable. When a second authentication service is added, this assumption becomes rarer, and the 436 new paths disappear along with the 271 stopped ends. The gain is real, but its cost is paid at the root itself.

For the second service to be able to make the same decisions, it needs to know the same shared secrets. That is, the secret of 80 devices sits in two places, and the number of places the root resides doubles. In the first lesson, what was replicated was a record, and copying it did not change the record’s correctness; what is replicated here is a secret, and every time a secret is copied, the compromise surface grows. The renewal bill also doubles unavoidably: 80 devices plus two service configurations.

If the item replicated for availability is a record, the cost is management; if it is a secret, the cost is surface. The second-service decision is made between these two sentences, and the decision’s correctness depends on whether the secrets are kept separate per device.

If the Shared Secret Is Compromised

The fourth table counts the root’s compromise. If a single device’s secret is compromised, the item dropped is one, and renewal ends with touching that one device. The problem is how many devices use the same secret: if it is the same across all devices, the dropped item rises to 80, and renewal means touching 80 devices manually. When a separate secret is kept per device, the same event’s renewal cost is one.

The service certificate row is this lesson’s inverse item. The certificate is a single item, but when it changes, the configuration of the 80 devices that trust it is updated; the number grows from 1 to 80 not in the certificate itself but in the number of items that reference it. This is the counterpart here of the chain of trust measured in the previous topic — if devices recognize the certificate directly instead of binding it to a chain, every step of the certificate’s lifecycle turns into an 80-item job.

The end credentials row drops zero. The identity of the ends sits in the directory and has nothing to do with the shared secret; root compromise serves to impersonate the device’s right to ask, not to capture the end’s identity. The two roots being separate keeps the compromise separate too.

Summary

• The 80 devices at the access layer hand their decision to a single central service; 1348 connection points and 957 connected ends depend on that answer.
• The decision chain is 6 items per device, and the fourth item is the service’s directory link; this bond chains the root measured in the first lesson to here.
• Fallback behaviors are extremes: closed behavior opens 0 paths but stops 957 ends, open behavior opens 1348 paths and stops no ends.
• The same 1348 paths reach 2 of 16 systems under critical segment and 16 of 16 under open; path count cannot be ranked without a reach column.
• In today’s mix, 436 new paths stay open, and 220 of them — heavy by reach — come from two device clusters; renewing the one shared secret means manually touching 80 devices.

Next Step

This lesson measured the access decision at network entry. A user who has entered the network connects to dozens of applications through the day, and is not asked to authenticate separately in each; they authenticate once, and that authentication is carried to the applications with an assertion. The identity provider’s signing key that produces the document is, this time, a single root for all of the applications. The next lesson measures federation on this axis: how many applications are bound to a single provider, how many applications drop if the root is compromised, how long the assertion lives, and how quickly closing one account takes effect in which application.