--- title: 'Authentication for Network Access' source: 'https://academia.sh/en/courses/identity-and-cryptography/authentication-for-network-access' course: 'Identity, Access and Cryptography' language: en updated: '2026-09-26T03:02:53+00:00' license: 'CC BY-SA 4.0' objectives: - 'Counts the devices that hand the access decision to the central service and extracts the decision chain item by item' - 'Separates the paths opened and the legitimate access stopped by fallback behaviors when the service is unreachable' - 'Calculates the items dropped when the shared secret is compromised and the manual cost of renewal' --- # Authentication for Network Access Measuring the central network authentication service in terms of access decisions: 80 devices asking a single service, a 6-item chain per device, four fallback behaviors opening between 0 and 1348 paths when the service is unreachable and stopping up to 957 legitimate ends, 436 new paths staying open in today's mix, and renewing the one shared secret meaning manually touching 80 devices. The previous lesson measured a principal accessing a service and counted the flow's six steps. All of the steps assumed the client was already connected to the network: a ticket request has to go from somewhere to somewhere. On enterprise networks, that connection itself is also a decision point. When a cable is plugged in or a device wants to join the wireless network, the edge switch or access point does not verify identity itself — it asks a central service and opens the connection point based on the answer. This lesson measures that service in terms of **access decisions**. How many devices ask a single service, how many items must be correct at the same time for the decision to be made, which fallback behavior is chosen when the service is unreachable, and how many paths each of those behaviors opens. The secret between the client and the network was measured in the **Network Security** course; what is measured here is the leg between the device and the service. ## The Service That Makes the Decision **EI8:** the device at the access layer does not verify identity itself; it asks a central network authentication service for the decision. The shared secret between the device and the service is the trust root of **every** access decision that device makes. **EI9:** when the service is unreachable, the device picks a fallback behavior; the behavior chosen determines both the number of paths opened and the legitimate access stopped, and not having picked one does not mean there is no behavior — the default is a choice too. **EI10:** the number of opened paths alone is not a ranking criterion; the same number of paths gives two different outcomes depending on how many systems are reached. This service's open specification is known by the name RADIUS, and the decision itself has two parts: the device's right to ask and the identity of the end. The first rests on the shared secret, the second on the credential the end presents. The service asks somewhere else to verify the second — the central directory measured in the previous lessons. ## Eighty Devices, One Service The inventory below is a **model**: the access layer of the fictional regional measurement network. There is no real organization, real device, or real secret. ```js // netaccess/access.mjs — the fictional regional measurement network's access-layer devices // connecting to the central network authentication service (model): there is no real // organization, real device, or real secret. No randomness. // EI8: the device at the access layer does not verify identity itself; it asks a central network // authentication service for the decision and opens the connection point based on the answer. The // shared secret between the service and the device is the trust root of every access decision that device makes. // Columns: count = number of devices, point = connection points that must authenticate, // end = currently connected legitimate ends, revoked = ends whose access was revoked recently. export const DEVICE = ` central-edge-switch switch 6 144 131 4 central-wireless-ap wireless 12 240 186 9 branch-edge-switch switch 18 216 174 7 branch-wireless-ap wireless 24 360 212 11 field-remote-access-endpoint remote 3 120 96 6 warehouse-edge-switch switch 5 60 41 2 meter-collection-switch switch 4 48 44 1 guest-wireless-ap wireless 8 160 73 3` .trim().split("\n").map((r) => { const p = r.trim().split(/\s+/); return { name: p[0], type: p[1], count: +p[2], point: +p[3], end: +p[4], revoked: +p[5] }; }); // EI9: when the service is unreachable the device picks a fallback behavior; the behavior // chosen determines both the opened path count and the stopped legitimate access. The "reach" // column is how many systems the fallen-back connection can reach (of the org's 16 systems). export const FALLBACK = { "closed": { new: (a) => 0, revoked: (a) => 0, stopped: (a) => a.end, reach: 0 }, "open": { new: (a) => a.point, revoked: (a) => a.revoked, stopped: (a) => 0, reach: 16 }, "critical-segment": { new: (a) => a.point, revoked: (a) => a.revoked, stopped: (a) => 0, reach: 2 }, "cache": { new: (a) => 0, revoked: (a) => a.revoked, stopped: (a) => 0, reach: 16 }, }; // EI10: the chain from the root to the decision is the items that must be correct at the same time, per device. export const CHAIN = ["shared secret", "service certificate", "end credential", "service's directory link", "policy record", "segment mapping"]; ``` ```js // netaccess/tally.mjs — how many devices ask a single service, how many items the chain is, which // fallback behavior opens how many paths when the service is unreachable, and what renewal costs if the shared secret is compromised. import { DEVICE, FALLBACK, CHAIN } from "./access.mjs"; const print = (g, ...s) => console.log(s.map((v, i) => (g[i] < 0 ? String(v).padEnd(-g[i]) : String(v).padStart(g[i]))).join("")); const total = (f, s = DEVICE) => s.reduce((a, x) => a + f(x), 0); const mode = Object.keys(FALLBACK); const count = total((a) => a.count); console.log(`${count} devices ask a single service, ${total((a) => a.point)} connection points, ` + `${total((a) => a.end)} connected ends, ${total((a) => a.revoked)} revoked ends`); console.log(`chain ${CHAIN.length} items, per device; ${count * CHAIN.length} items in the domain`); const A = [-10, 8, 8, 8, 9, 8]; console.log("\n1. load by device type"); print(A, "type", "devices", "points", "ends", "revoked", "items"); for (const t of ["switch", "wireless", "remote"]) { const s = DEVICE.filter((a) => a.type === t); print(A, t, total((a) => a.count, s), total((a) => a.point, s), total((a) => a.end, s), total((a) => a.revoked, s), total((a) => a.count, s) * CHAIN.length); } const B = [-18, 10, 15, 14, 9]; console.log("\n2. same network, four fallback modes, service unreachable"); print(B, "mode", "new paths", "revoked paths", "stopped ends", "reach"); for (const m of mode) { const g = FALLBACK[m]; print(B, m, total(g.new), total(g.revoked), total(g.stopped), `${g.reach}/16`); } const C = [-30, -18, 10, 15, 14]; console.log("\n3. today's mode mix across devices, with outcome"); const choice = { "central-edge-switch": "closed", "central-wireless-ap": "cache", "branch-edge-switch": "critical-segment", "branch-wireless-ap": "cache", "field-remote-access-endpoint": "closed", "warehouse-edge-switch": "open", "meter-collection-switch": "closed", "guest-wireless-ap": "open" }; print(C, "device", "mode", "new paths", "revoked paths", "stopped ends"); let y = 0, r = 0, d = 0; for (const a of DEVICE) { const g = FALLBACK[choice[a.name]]; y += g.new(a); r += g.revoked(a); d += g.stopped(a); print(C, a.name, choice[a.name], g.new(a), g.revoked(a), g.stopped(a)); } print(C, "total", "-", y, r, d); const D = [-34, 8, 10, 22]; console.log("\n4. what drops if the shared secret is compromised, and renewal"); print(D, "item", "count", "dropped", "renewal"); const row = [ ["a single device's secret", 1, 1, "1 device manually"], ["devices sharing the same secret", count, count, `${count} devices manually`], ["affected points", total((a) => a.point), total((a) => a.point), "automatically"], ["service certificate", 1, count, `${count} devices manually`], ["end credentials", total((a) => a.end), 0, "unaffected"], ]; for (const s of row) print(D, ...s); console.log(`manual items if the secret is identical across all devices ${count}, if separate 1`); ``` ``` 80 devices ask a single service, 1348 connection points, 957 connected ends, 43 revoked ends chain 6 items, per device; 480 items in the domain 1. load by device type type devices points ends revoked items switch 33 468 390 14 198 wireless 44 760 471 23 264 remote 3 120 96 6 18 2. same network, four fallback modes, service unreachable mode new paths revoked paths stopped ends reach closed 0 0 957 0/16 open 1348 43 0 16/16 critical-segment 1348 43 0 2/16 cache 0 43 0 16/16 3. today's mode mix across devices, with outcome device mode new paths revoked paths stopped ends central-edge-switch closed 0 0 131 central-wireless-ap cache 0 9 0 branch-edge-switch critical-segment 216 7 0 branch-wireless-ap cache 0 11 0 field-remote-access-endpoint closed 0 0 96 warehouse-edge-switch open 60 2 0 meter-collection-switch closed 0 0 44 guest-wireless-ap open 160 3 0 total - 436 32 271 4. what drops if the shared secret is compromised, and renewal item count dropped renewal a single device's secret 1 1 1 device manually devices sharing the same secret 80 80 80 devices manually affected points 1348 1348 automatically service certificate 1 80 80 devices manually end credentials 957 0 unaffected manual items if the secret is identical across all devices 80, if separate 1 ``` The numbers are of the **measurement** class; their inputs are EI8–EI10 and the device inventory. ## Chain and Load The header line gives the size of the dependency: 80 devices ask a single service, 1348 connection points depend on that answer, and there are 957 currently connected ends. For the decision to be made, six items per device must be correct at the same time — the shared secret, the service's certificate, the end's credential, the service's directory link, the policy record, and the segment mapping. None of the total 480 items in the domain holds on its own. The fourth of these six items is a chained dependency and ties the previous two lessons in here. The service does not know the end's identity itself; it asks the central directory. That is, behind the decision between a cable being plugged in and a port being opened stand **two** roots: the secret between the device and the service, and the link between the service and the directory. The first is this lesson's subject, the second was measured in the first lesson, where the number of systems stalling during the directory outage was 13; this lesson adds 1348 connection points to that list. The load is not evenly distributed. Wireless devices carry more than half the device count with 44, and 56% of the connection points with 760 points. The remote access endpoint is only three devices but holds 120 points and 96 ends; the number of points per device is 40, and this is the densest item on the list. A single device's misconfiguration produces a result proportional not to the device count, but to the number of points it carries. ## Four Behaviors When the Service Is Unreachable The second table runs the same network through four fallback behaviors. In the closed behavior, no unverified device can get in — new paths zero, revoked paths zero — but **957 ends stop**. This row is the safest and most expensive choice on the list; an authentication service's outage turns into the whole network's outage. The open behavior is the exact opposite: no legitimate end stops, but all 1348 points open to an unverified device, and the opened connection reaches 16 of 16 systems. The critical-segment behavior opens **the same 1348 paths**; the difference is that the opened connection reaches only two of the 16 systems. This is EI10's measure: the two rows' path counts are identical, their outcomes are not. A measurement that writes path counting without a reach column cannot tell these two rows apart. The cache behavior looks better than both at first glance: new paths zero, stopped ends zero. Its cost is in the third column — 43 ends whose access was revoked keep entering the network. This is the third appearance of the same pattern counted as the cache window in the first lesson and the ticket lifetime in the second lesson. **Caching a decision delays the decision's revocation by the caching duration**; the mechanism changes, the number lands in the same place. ## Today's Mix The third table shows the behavior is not chosen uniformly across the network. Of the eight device clusters, four are set to closed, two to cache, one to critical segment, one to open. In total 436 new paths stay open, 32 revoked paths pass through, and 271 ends stop. The number 436 cannot be read on its own. 216 of it comes from the branch switches assigned to critical segment, and those paths reach two systems; the remaining 220 come from the two device clusters set to open, and they reach all 16 systems. When multiplied by reach, the gap opens up: while the path counts are almost equal, 216 of critical segment reaches only two systems, while 220 of open reaches all sixteen. Leaving the guest wireless access points open can be a reasonable decision, but its reasonableness rests on being bound to a separate segment, and as long as that segment is not written in the table, the decision's correctness cannot be measured. The 271 stopped ends do not come from one place either: 131 from central switches, 96 from the remote access endpoint, 44 from the meter collection switch. The remote access endpoint being set to closed behavior means all 96 field ends going connection-less during a service outage. **A fallback behavior looks like a security setting; in reality it is part of the outage plan.** ## What a Second Service Changes The entire fallback table rests on a single assumption: the service is unreachable. When a second authentication service is added, this assumption becomes rarer, and the 436 new paths disappear along with the 271 stopped ends. The gain is real, but its cost is paid at the root itself. For the second service to be able to make the same decisions, it needs to know the same shared secrets. That is, the secret of 80 devices sits in two places, and the number of places the root resides doubles. In the first lesson, what was replicated was a record, and copying it did not change the record's correctness; what is replicated here is a **secret**, and every time a secret is copied, the compromise surface grows. The renewal bill also doubles unavoidably: 80 devices plus two service configurations. **If the item replicated for availability is a record, the cost is management; if it is a secret, the cost is surface.** The second-service decision is made between these two sentences, and the decision's correctness depends on whether the secrets are kept separate per device. ## If the Shared Secret Is Compromised The fourth table counts the root's compromise. If a single device's secret is compromised, the item dropped is one, and renewal ends with touching that one device. The problem is how many devices use the same secret: if it is the same across all devices, the dropped item rises to 80, and renewal means touching 80 devices **manually**. When a separate secret is kept per device, the same event's renewal cost is one. The service certificate row is this lesson's inverse item. The certificate is a single item, but when it changes, the configuration of the 80 devices that trust it is updated; the number grows from 1 to 80 not in the certificate itself but in the number of items that reference it. This is the counterpart here of the chain of trust measured in the previous topic — if devices recognize the certificate directly instead of binding it to a chain, every step of the certificate's lifecycle turns into an 80-item job. The end credentials row drops zero. The identity of the ends sits in the directory and has nothing to do with the shared secret; root compromise serves to impersonate the device's **right to ask**, not to capture the end's identity. The two roots being separate keeps the compromise separate too. ## Summary - The 80 devices at the access layer hand their decision to a single central service; 1348 connection points and 957 connected ends depend on that answer. - The decision chain is 6 items per device, and the fourth item is the service's directory link; this bond chains the root measured in the first lesson to here. - Fallback behaviors are extremes: closed behavior opens 0 paths but stops 957 ends, open behavior opens 1348 paths and stops no ends. - The same 1348 paths reach 2 of 16 systems under critical segment and 16 of 16 under open; path count cannot be ranked without a reach column. - In today's mix, 436 new paths stay open, and 220 of them — heavy by reach — come from two device clusters; renewing the one shared secret means manually touching 80 devices. ## Next Step This lesson measured the access decision **at network entry**. A user who has entered the network connects to dozens of applications through the day, and is not asked to authenticate separately in each; they authenticate once, and that authentication is carried to the applications with an **assertion**. The identity provider's signing key that produces the document is, this time, a single root for all of the applications. The next lesson measures federation on this axis: how many applications are bound to a single provider, how many applications drop if the root is compromised, how long the assertion lives, and how quickly closing one account takes effect in which application.