Authentication Methods

The previous lesson measured the length of the shared secret and calculated its resistance to offline guessing. Who the secret belongs to was never asked. All four generations had a single string; that string was identical across meter endpoints, branch laptops, and field terminals.

This distinction is what separates the two modes of wireless authentication from each other. In personal mode the trust root is a single shared secret: whoever knows it is on the network. In enterprise mode the trust root is a separate identity per subject, and a central authentication server performs the verification. This lesson measures the two in three columns: how many items are reached when a trust root is compromised, how many steps revocation takes, and how many infrastructure items the separation costs.

• WS7. An item is a resource reachable once connected to the wireless network: a service, a repository, a management interface. Twelve items are defined in the fictional regional measurement network.
• WS8. In personal mode a network has a single shared secret. Every subject that enters that network reaches all of the network’s items; separating items can only be done by splitting the network — that is, by opening a separate network and a separate secret.
• WS9. In enterprise mode, authorization is tied to identity; a subject reaches only the items legitimate to its role. The mapping of roles to items is a model decision.
• WS10. Manual configuration per device is four minutes, and annual staff turnover is fourteen percent; both are fictional model constants.
• WS11. The annual maintenance touch of an additional infrastructure item is a model value: how many times a year that item is manually replaced or renewed.
• WS12. The internal workings of the authentication server, token mechanics, and identity federation are outside this lesson; what is measured is only where the trust root stands.

The Item a Secret Opens

Personal mode’s measure is a single number: how many items are reached when a secret is compromised. The only way to shrink that number is to split the network, and every split means a new secret.

// mode.mjs — trust-root model of personal and enterprise mode. Fictional regional measurement
// network; no real network name, real location, or real identity is written.
export const ITEM = ['measurement-store', 'aggregator-ingress', 'work-order-service',
  'subscriber-registry', 'billing-db', 'configuration', 'management-interface', 'panel-feed',
  'printer-queue', 'branch-file-share', 'field-map', 'update-repository'];
// [role, subject count, device count, items legitimately reachable]
export const ROLE = [
  ['field-technician', 43, 183, ['work-order-service', 'field-map', 'subscriber-registry']],
  ['branch-staff', 210, 210, ['work-order-service', 'subscriber-registry', 'billing-db',
    'branch-file-share', 'printer-queue']],
  ['maintenance', 9, 9, ['configuration', 'management-interface', 'update-repository', 'measurement-store']],
  ['panel', 0, 12, ['panel-feed']],
  ['barcode-printer', 0, 26, ['printer-queue']],
  ['meter-endpoint', 0, 4100, ['aggregator-ingress']],
];
// In personal mode a network has one single shared secret; every subject that enters that
// network reaches all of the network's items. Role distribution per network is a design decision.
export const PLAN = [
  ['single-network', [['field-technician', 'branch-staff', 'maintenance', 'panel',
    'barcode-printer', 'meter-endpoint']]],
  ['three-networks', [['field-technician', 'branch-staff'], ['maintenance', 'panel',
    'barcode-printer'], ['meter-endpoint']]],
  ['network-per-role', ROLE.map(([r]) => [r])],
];
export const items = (roles) =>
  [...new Set(roles.flatMap((r) => ROLE.find(([a]) => a === r)[3]))];
export const devices = (roles) =>
  roles.reduce((s, r) => s + ROLE.find(([a]) => a === r)[2], 0);
// Enterprise mode's additional infrastructure items and each item's annual maintenance touch (model).
export const INFRASTRUCTURE = [
  ['identity authentication server', 2], ['server identity and trust root', 1],
  ['identity store connection', 2], ['client profile distribution', 6],
  ['access point shared secret', 4], ['identity revocation list', 12],
  ['backup authentication path', 2],
];
// Device classes that support enterprise mode (model decision).
export const ENTERPRISE_SUPPORT = ['field-technician', 'branch-staff', 'maintenance'];

// run1.mjs — items reached when a secret leaks, and the step count for changing that secret
import { ITEM, ROLE, PLAN, items, devices } from './mode.mjs';

const DEVICE_TOTAL = ROLE.reduce((s, [, , n]) => s + n, 0);
const MANUAL = 4;                     // manual configuration minutes per device (model constant)
const E = [20, 8, 16, 14, 16, 14];
const row = (h) => h.map((d, i) => String(d)[i ? 'padStart' : 'padEnd'](E[i])).join('');
console.log(`item ${ITEM.length}, role ${ROLE.length}, device ${DEVICE_TOTAL}`);
console.log(row(['personal mode plan', 'secret', 'widest item', 'avg. item', 'most devices',
  'secret change']));
for (const [name, nets] of PLAN) {
  const item = nets.map((g) => items(g).length);
  const device = nets.map((g) => devices(g));
  console.log(row([name, nets.length, Math.max(...item),
    (item.reduce((a, b) => a + b, 0) / nets.length).toFixed(1), Math.max(...device),
    `${Math.max(...device) * MANUAL} min`]));
}
// Enterprise mode: identity is per subject, authorization is tied to identity.
const enterprise = ROLE.map(([r, , , k]) => k.length);
console.log(row(['enterprise mode', ROLE.reduce((s, [, o, a]) => s + (o || a), 0),
  Math.max(...enterprise), (enterprise.reduce((a, b) => a + b, 0) / ROLE.length).toFixed(1), 1,
  `${MANUAL} min`]));

item 12, role 6, device 4540
personal mode plan    secret     widest item     avg. item    most devices secret change
single-network             1              12          12.0            4540     18160 min
three-networks             3               6           4.3            4100     16400 min
network-per-role           6               5           2.5            4100     16400 min
enterprise mode         4400               5           2.5               1         4 min

The first row is personal mode in its plainest form: a single network, a single secret, twelve items. A compromised secret opens the entire network; there is no separation between items, because there is no identity to make that separation.

Splitting the network works. Moving to three networks brings the widest secret down from twelve items to six, and the average down to four point three. Splitting per role brings the average down to two point five — the same value as enterprise mode. This row is the lesson’s first surprise: enterprise mode is not required for item separation; splitting the network finely enough gives the same separation.

The difference is in the last two columns. Network-per-role means six separate broadcasts, six separate secrets, and six separate configurations at every access point; none of this shows up in the item count. The real difference is the secret change column. In personal mode, when a secret changes, every device on that network is touched: the most crowded network carries four thousand one hundred devices, so that is sixteen thousand four hundred minutes, roughly two hundred seventy-three hours. In enterprise mode what changes is a single identity, and the number of devices touched is one.

The number four thousand four hundred, appearing in enterprise mode’s column, is the cost itself: the number of identities to manage climbs from one secret to four thousand four hundred. Item separation is not free; the cost of the separation is the scale of identity management.

The Step Count of Revocation, and the Claim Added

The point where the two modes actually diverge is a subject’s departure. The run below first builds the claim table, then counts the cost of a departing subject.

// run2.mjs — the two modes' claim table and the cost of enterprise mode
import { ROLE, INFRASTRUCTURE, ENTERPRISE_SUPPORT, items, devices } from './mode.mjs';

const LEVEL = ['none', 'weak', 'proven'];
const CLAIM = [
  ['connecting party knows the secret', [2, 2, 2]],
  ['connecting party is a specific subject', [0, 2, 2]],
  ['this identity is still valid', [0, 2, 2]],
  ["access is limited to the subject's items", [0, 2, 2]],
  ["other party is the organization's identity server", [1, 0, 2]],
  ['departed subject is automatically outside', [0, 2, 2]],
  ['session key is separate per subject', [0, 2, 2]],
];
const HEADER = ['personal', 'enterprise (server not verified)', 'enterprise (trust root fixed)'];
const E = [52, 10, 36, 32];
const row = (h) => h.map((d, i) => String(d)[i ? 'padStart' : 'padEnd'](E[i])).join('');
console.log(row(['claim', ...HEADER]));
for (const [name, d] of CLAIM) console.log(row([name, ...d.map((v) => LEVEL[v])]));
const count = (i, v) => CLAIM.filter(([, d]) => d[i] === v).length;
console.log(row(['proven / open', ...HEADER.map((_, i) =>
  `${count(i, 2)} / ${count(i, 1) + count(i, 0)}`)]));

// A departing subject: in personal mode the network secret changes, in enterprise mode a single identity changes.
const MANUAL = 4, TURNOVER = 0.14;    // minutes per device and annual staff turnover (model)
const SUBJECT = ROLE.reduce((s, [, o]) => s + o, 0);
const NETWORKS = [['field-technician', 'branch-staff'], ['maintenance', 'panel',
  'barcode-printer'], ['meter-endpoint']];
const group = NETWORKS.find((x) => x.includes('field-technician'));
const touched = devices(group);
console.log(`\nsubject ${SUBJECT}, annual departures ${Math.round(SUBJECT * TURNOVER)}`);
console.log(`personal: 1 secret changes -> ${touched} devices, ${touched * MANUAL} min, ` +
  `${items(group).length} items reopened`);
console.log('enterprise: 1 identity revoked -> 0 devices, 0 min, 0 items');
console.log(`annual: personal ${Math.round(SUBJECT * TURNOVER) * touched * MANUAL} min, enterprise 0 min`);

// Cost: additional infrastructure items and devices that cannot support enterprise mode.
const outside = ROLE.filter(([r]) => !ENTERPRISE_SUPPORT.includes(r));
console.log(`\nadditional infrastructure items ${INFRASTRUCTURE.length}, annual maintenance ` +
  `touches ${INFRASTRUCTURE.reduce((s, [, n]) => s + n, 0)}`);
for (const [name, n] of INFRASTRUCTURE) console.log(`  ${name.padEnd(38)}${String(n).padStart(3)}`);
console.log(`classes not supporting enterprise mode ${outside.length}, devices ` +
  `${outside.reduce((s, [, , n]) => s + n, 0)} -> stay in personal mode`);

claim                                                 personal    enterprise (server not verified)   enterprise (trust root fixed)
connecting party knows the secret                       proven                              proven                          proven
connecting party is a specific subject                    none                              proven                          proven
this identity is still valid                              none                              proven                          proven
access is limited to the subject's items                  none                              proven                          proven
other party is the organization's identity server         weak                                none                          proven
departed subject is automatically outside                 none                              proven                          proven
session key is separate per subject                       none                              proven                          proven
proven / open                                            1 / 6                               6 / 1                           7 / 0

subject 262, annual departures 37
personal: 1 secret changes -> 393 devices, 1572 min, 6 items reopened
enterprise: 1 identity revoked -> 0 devices, 0 min, 0 items
annual: personal 58164 min, enterprise 0 min

additional infrastructure items 7, annual maintenance touches 29
  identity authentication server          2
  server identity and trust root          1
  identity store connection               2
  client profile distribution             6
  access point shared secret              4
  identity revocation list               12
  backup authentication path              2
classes not supporting enterprise mode 3, devices 4138 -> stay in personal mode

Personal mode ties one of seven claims to proof: that the connecting party knows the secret. Five of the remaining six have no counterpart at all, because the secret belongs to the network, not to the person; the sixth has only a weak counterpart. The question “is this identity still valid” has no answer at all in personal mode; there is validity of a secret, but no such concept as validity of an identity.

The departure row turns this into money. Thirty-seven of two hundred sixty-two subjects depart per year. In personal mode, every departing subject means that network’s secret must change: three hundred ninety-three devices on the network are touched, one thousand five hundred seventy-two minutes are spent, and six items are reopened. The annual total is fifty-eight thousand one hundred sixty-four minutes, roughly nine hundred seventy hours. In enterprise mode the counterpart to that same number is zero.

In practice this number is not paid. Instead of spending one thousand five hundred seventy-two minutes thirty-seven times over, the secret is not changed; the string the departing subject knew stays on the network. This is personal mode’s real weakness — not that the secret is singular, but that the cost of revoking it is too large to be paid.

The model also leaves one source completely uncounted. A departing subject does not only carry away the string in their memory; a copy of the secret also sits in the configuration of every device it was left on. A lost field terminal, a meter endpoint that is unmounted and taken, or a panel display that is discarded produces the same result, and none of it shows up in the staff turnover number. In personal mode device loss and staff departure are the same event, because both carry the same single trust root outward. In enterprise mode these are two separate events, and both have the same remedy: revoking a single record.

The Claim Added and the Cost Paid

The middle column is this lesson’s real finding. Enterprise mode ties six claims to proof but adds a new claim: that the other party is the organization’s authentication server. In personal mode this claim is met only weakly — the shared secret is known by both parties, and whoever knows the secret is treated as the network itself. In enterprise mode the client presents its identity to a central server, and who that server is becomes a separate question.

If the client does not verify the server’s identity and trust root, this claim has no proof at all. The table states this plainly: that row is empty in the middle column. Enterprise mode, when not configured correctly, loses even personal mode’s one proof, and gains in exchange a server whose identity must be presented. When the trust root is fixed, seven of seven claims are tied to proof; when it is not fixed, the number of open claims drops to one, but the claim that stays open is the most expensive one. The next lesson will measure what it means for that claim to stay open.

The last section counts the cost. Enterprise mode brings seven additional infrastructure items, and these items are touched by hand twenty-nine times a year. The most frequently touched item is the identity revocation list; the most critical one is the trust root, because when it is renewed, every client profile must be renewed with it.

The device side limits the decision. Three of the six roles support enterprise mode; the remaining three classes, four thousand one hundred thirty-eight devices, must stay in personal mode. Most of these are meter endpoints, and each connects to a single item, the aggregator ingress. This means the move to enterprise mode is a partial move: roles with subjects go to enterprise mode, subjectless devices go to personal-mode networks split per role. The measurement supports this split — the average item count opened for all four thousand one hundred thirty-eight devices is already one.

Summary

• In personal mode, a single network and a single secret open all twelve items; splitting the network per role brings the average down to 2.5 items, the same separation enterprise mode gives. Enterprise mode is not required for item separation.
• The separation is not free: in personal mode, changing a secret touches every device on that network (16,400 minutes on the most crowded network); in enterprise mode a single identity is revoked (0 minutes, 0 devices). The number of trust roots to manage climbs from 1 to 4,400.
• A departing subject requires touching 393 devices in personal mode; 37 annual departures cost 58,164 minutes. Because this cost is not paid, the secret is not changed, and the string the departed subject knew stays on the network.
• Enterprise mode ties six of seven claims to proof but adds a claim: that the other party is the organization’s authentication server. If the trust root is not fixed, that claim has no proof.
• The cost is seven additional infrastructure items and twenty-nine manual touches a year; three of six roles, 4,138 devices, cannot support enterprise mode and stay in personal mode.

Next Step

This lesson put the trust root in place and left one row of the table open: whether the client verifies who the other party is. What it means for that row to stay empty is not a configuration detail. When a client decides to connect to a network, all it has is the announcements that network makes about itself — this is exactly the network name claim that stayed unproven in all four generations in the first lesson’s table. The next lesson’s question is: what does a client look at to accept a network’s identity, how many of those signals carry proof, how many paths does a saved network profile open by itself, and how many of those paths does mutual authentication close.