---
title: 'Authentication Methods'
source: 'https://academia.sh/en/courses/network-security/authentication-methods'
course: 'Network Security'
language: en
updated: '2026-09-26T03:02:54+00:00'
license: 'CC BY-SA 4.0'
objectives:
    - 'Separates personal and enterprise mode in terms of trust root: counts the items opened by a shared secret against those opened by a per-subject identity'
    - 'Calculates how many steps, devices, and minutes revoking a secret or an identity requires'
    - 'Finds the claim enterprise mode adds and shows that it is not verified under the default configuration'
    - "Counts enterprise mode's additional infrastructure items and the device classes left out"
---

# Authentication Methods

Personal and enterprise mode are separated in terms of trust root: a single shared secret in personal mode grants access to all twelve items on a network, and changing it means touching four thousand five hundred forty devices; per-person identity in enterprise mode brings that down to an average of two and a half items, and revocation is a single step. Enterprise mode ties six of seven claims to proof but adds one claim, and does not verify it under the default configuration.

The previous lesson measured the length of the shared secret and calculated its resistance to
offline guessing. **Who the secret belongs to** was never asked. All four generations had a
single string; that string was identical across meter endpoints, branch laptops, and field
terminals.

This distinction is what separates the two modes of wireless authentication from each other. In
**personal mode** the trust root is a single shared secret: whoever knows it is on the network.
In **enterprise mode** the trust root is a separate identity per subject, and a central
authentication server performs the verification. This lesson measures the two in three columns:
how many items are reached when a trust root is compromised, how many steps revocation takes,
and how many infrastructure items the separation costs.

- **WS7.** An item is a resource reachable once connected to the wireless network: a service, a
  repository, a management interface. Twelve items are defined in the fictional regional
  measurement network.
- **WS8.** In personal mode a network has a **single** shared secret. Every subject that enters
  that network reaches all of the network's items; separating items can only be done by
  splitting the network — that is, by opening a separate network and a separate secret.
- **WS9.** In enterprise mode, authorization is tied to identity; a subject reaches only the
  items legitimate to its role. The mapping of roles to items is a model decision.
- **WS10.** Manual configuration per device is four minutes, and annual staff turnover is
  fourteen percent; both are fictional model constants.
- **WS11.** The annual maintenance touch of an additional infrastructure item is a model value:
  how many times a year that item is manually replaced or renewed.
- **WS12.** The internal workings of the authentication server, token mechanics, and identity
  federation are outside this lesson; what is measured is only where the trust root stands.

## The Item a Secret Opens

Personal mode's measure is a single number: how many items are reached when a secret is
compromised. The only way to shrink that number is to split the network, and every split means a
new secret.

```js
// mode.mjs — trust-root model of personal and enterprise mode. Fictional regional measurement
// network; no real network name, real location, or real identity is written.
export const ITEM = ['measurement-store', 'aggregator-ingress', 'work-order-service',
  'subscriber-registry', 'billing-db', 'configuration', 'management-interface', 'panel-feed',
  'printer-queue', 'branch-file-share', 'field-map', 'update-repository'];
// [role, subject count, device count, items legitimately reachable]
export const ROLE = [
  ['field-technician', 43, 183, ['work-order-service', 'field-map', 'subscriber-registry']],
  ['branch-staff', 210, 210, ['work-order-service', 'subscriber-registry', 'billing-db',
    'branch-file-share', 'printer-queue']],
  ['maintenance', 9, 9, ['configuration', 'management-interface', 'update-repository', 'measurement-store']],
  ['panel', 0, 12, ['panel-feed']],
  ['barcode-printer', 0, 26, ['printer-queue']],
  ['meter-endpoint', 0, 4100, ['aggregator-ingress']],
];
// In personal mode a network has one single shared secret; every subject that enters that
// network reaches all of the network's items. Role distribution per network is a design decision.
export const PLAN = [
  ['single-network', [['field-technician', 'branch-staff', 'maintenance', 'panel',
    'barcode-printer', 'meter-endpoint']]],
  ['three-networks', [['field-technician', 'branch-staff'], ['maintenance', 'panel',
    'barcode-printer'], ['meter-endpoint']]],
  ['network-per-role', ROLE.map(([r]) => [r])],
];
export const items = (roles) =>
  [...new Set(roles.flatMap((r) => ROLE.find(([a]) => a === r)[3]))];
export const devices = (roles) =>
  roles.reduce((s, r) => s + ROLE.find(([a]) => a === r)[2], 0);
// Enterprise mode's additional infrastructure items and each item's annual maintenance touch (model).
export const INFRASTRUCTURE = [
  ['identity authentication server', 2], ['server identity and trust root', 1],
  ['identity store connection', 2], ['client profile distribution', 6],
  ['access point shared secret', 4], ['identity revocation list', 12],
  ['backup authentication path', 2],
];
// Device classes that support enterprise mode (model decision).
export const ENTERPRISE_SUPPORT = ['field-technician', 'branch-staff', 'maintenance'];
```

```js
// run1.mjs — items reached when a secret leaks, and the step count for changing that secret
import { ITEM, ROLE, PLAN, items, devices } from './mode.mjs';

const DEVICE_TOTAL = ROLE.reduce((s, [, , n]) => s + n, 0);
const MANUAL = 4;                     // manual configuration minutes per device (model constant)
const E = [20, 8, 16, 14, 16, 14];
const row = (h) => h.map((d, i) => String(d)[i ? 'padStart' : 'padEnd'](E[i])).join('');
console.log(`item ${ITEM.length}, role ${ROLE.length}, device ${DEVICE_TOTAL}`);
console.log(row(['personal mode plan', 'secret', 'widest item', 'avg. item', 'most devices',
  'secret change']));
for (const [name, nets] of PLAN) {
  const item = nets.map((g) => items(g).length);
  const device = nets.map((g) => devices(g));
  console.log(row([name, nets.length, Math.max(...item),
    (item.reduce((a, b) => a + b, 0) / nets.length).toFixed(1), Math.max(...device),
    `${Math.max(...device) * MANUAL} min`]));
}
// Enterprise mode: identity is per subject, authorization is tied to identity.
const enterprise = ROLE.map(([r, , , k]) => k.length);
console.log(row(['enterprise mode', ROLE.reduce((s, [, o, a]) => s + (o || a), 0),
  Math.max(...enterprise), (enterprise.reduce((a, b) => a + b, 0) / ROLE.length).toFixed(1), 1,
  `${MANUAL} min`]));
```

```
item 12, role 6, device 4540
personal mode plan    secret     widest item     avg. item    most devices secret change
single-network             1              12          12.0            4540     18160 min
three-networks             3               6           4.3            4100     16400 min
network-per-role           6               5           2.5            4100     16400 min
enterprise mode         4400               5           2.5               1         4 min
```

The first row is personal mode in its plainest form: a single network, a single secret, twelve
items. A compromised secret opens the entire network; there is no separation between items,
because there is no identity to make that separation.

Splitting the network works. Moving to three networks brings the widest secret down from twelve
items to six, and the average down to four point three. Splitting per role brings the average
down to two point five — the **same** value as enterprise mode. This row is the lesson's first
surprise: enterprise mode is not required for item separation; splitting the network finely
enough gives the same separation.

The difference is in the last two columns. Network-per-role means six separate broadcasts, six
separate secrets, and six separate configurations at every access point; none of this shows up in
the item count. The real difference is the **secret change** column. In personal mode, when a
secret changes, every device on that network is touched: the most crowded network carries four
thousand one hundred devices, so that is sixteen thousand four hundred minutes, roughly two
hundred seventy-three hours. In enterprise mode what changes is a single identity, and the
number of devices touched is one.

The number four thousand four hundred, appearing in enterprise mode's column, is the cost
itself: the number of identities to manage climbs from one secret to four thousand four hundred.
Item separation is not free; the cost of the separation is the scale of identity management.

## The Step Count of Revocation, and the Claim Added

The point where the two modes actually diverge is a subject's **departure**. The run below first
builds the claim table, then counts the cost of a departing subject.

```js
// run2.mjs — the two modes' claim table and the cost of enterprise mode
import { ROLE, INFRASTRUCTURE, ENTERPRISE_SUPPORT, items, devices } from './mode.mjs';

const LEVEL = ['none', 'weak', 'proven'];
const CLAIM = [
  ['connecting party knows the secret', [2, 2, 2]],
  ['connecting party is a specific subject', [0, 2, 2]],
  ['this identity is still valid', [0, 2, 2]],
  ["access is limited to the subject's items", [0, 2, 2]],
  ["other party is the organization's identity server", [1, 0, 2]],
  ['departed subject is automatically outside', [0, 2, 2]],
  ['session key is separate per subject', [0, 2, 2]],
];
const HEADER = ['personal', 'enterprise (server not verified)', 'enterprise (trust root fixed)'];
const E = [52, 10, 36, 32];
const row = (h) => h.map((d, i) => String(d)[i ? 'padStart' : 'padEnd'](E[i])).join('');
console.log(row(['claim', ...HEADER]));
for (const [name, d] of CLAIM) console.log(row([name, ...d.map((v) => LEVEL[v])]));
const count = (i, v) => CLAIM.filter(([, d]) => d[i] === v).length;
console.log(row(['proven / open', ...HEADER.map((_, i) =>
  `${count(i, 2)} / ${count(i, 1) + count(i, 0)}`)]));

// A departing subject: in personal mode the network secret changes, in enterprise mode a single identity changes.
const MANUAL = 4, TURNOVER = 0.14;    // minutes per device and annual staff turnover (model)
const SUBJECT = ROLE.reduce((s, [, o]) => s + o, 0);
const NETWORKS = [['field-technician', 'branch-staff'], ['maintenance', 'panel',
  'barcode-printer'], ['meter-endpoint']];
const group = NETWORKS.find((x) => x.includes('field-technician'));
const touched = devices(group);
console.log(`\nsubject ${SUBJECT}, annual departures ${Math.round(SUBJECT * TURNOVER)}`);
console.log(`personal: 1 secret changes -> ${touched} devices, ${touched * MANUAL} min, ` +
  `${items(group).length} items reopened`);
console.log('enterprise: 1 identity revoked -> 0 devices, 0 min, 0 items');
console.log(`annual: personal ${Math.round(SUBJECT * TURNOVER) * touched * MANUAL} min, enterprise 0 min`);

// Cost: additional infrastructure items and devices that cannot support enterprise mode.
const outside = ROLE.filter(([r]) => !ENTERPRISE_SUPPORT.includes(r));
console.log(`\nadditional infrastructure items ${INFRASTRUCTURE.length}, annual maintenance ` +
  `touches ${INFRASTRUCTURE.reduce((s, [, n]) => s + n, 0)}`);
for (const [name, n] of INFRASTRUCTURE) console.log(`  ${name.padEnd(38)}${String(n).padStart(3)}`);
console.log(`classes not supporting enterprise mode ${outside.length}, devices ` +
  `${outside.reduce((s, [, , n]) => s + n, 0)} -> stay in personal mode`);
```

```
claim                                                 personal    enterprise (server not verified)   enterprise (trust root fixed)
connecting party knows the secret                       proven                              proven                          proven
connecting party is a specific subject                    none                              proven                          proven
this identity is still valid                              none                              proven                          proven
access is limited to the subject's items                  none                              proven                          proven
other party is the organization's identity server         weak                                none                          proven
departed subject is automatically outside                 none                              proven                          proven
session key is separate per subject                       none                              proven                          proven
proven / open                                            1 / 6                               6 / 1                           7 / 0

subject 262, annual departures 37
personal: 1 secret changes -> 393 devices, 1572 min, 6 items reopened
enterprise: 1 identity revoked -> 0 devices, 0 min, 0 items
annual: personal 58164 min, enterprise 0 min

additional infrastructure items 7, annual maintenance touches 29
  identity authentication server          2
  server identity and trust root          1
  identity store connection               2
  client profile distribution             6
  access point shared secret              4
  identity revocation list               12
  backup authentication path              2
classes not supporting enterprise mode 3, devices 4138 -> stay in personal mode
```

Personal mode ties **one** of seven claims to proof: that the connecting party knows the secret.
Five of the remaining six have no counterpart at all, because the secret belongs to the network,
not to the person; the sixth has only a weak counterpart. The question "is this identity still
valid" has no answer at all in personal mode; there is validity of a secret, but no such concept
as validity of an identity.

The departure row turns this into money. Thirty-seven of two hundred sixty-two subjects depart
per year. In personal mode, every departing subject means that network's secret must change:
three hundred ninety-three devices on the network are touched, one thousand five hundred
seventy-two minutes are spent, and six items are reopened. The annual total is fifty-eight
thousand one hundred sixty-four minutes, roughly nine hundred seventy hours. In enterprise mode
the counterpart to that same number is zero.

In practice this number is not paid. Instead of spending one thousand five hundred seventy-two
minutes thirty-seven times over, the secret is **not changed**; the string the departing subject
knew stays on the network. This is personal mode's real weakness — not that the secret is
singular, but that the cost of revoking it is too large to be paid.

The model also leaves one source completely uncounted. A departing subject does not only carry
away the string in their memory; a copy of the secret also sits in the configuration of every
device it was left on. A lost field terminal, a meter endpoint that is unmounted and taken, or a
panel display that is discarded produces the same result, and none of it shows up in the staff
turnover number. In personal mode **device loss and staff departure are the same event**,
because both carry the same single trust root outward. In enterprise mode these are two separate
events, and both have the same remedy: revoking a single record.

## The Claim Added and the Cost Paid

The middle column is this lesson's real finding. Enterprise mode ties six claims to proof but
**adds a new claim**: that the other party is the organization's authentication server. In
personal mode this claim is met only weakly — the shared secret is known by both parties, and
whoever knows the secret is treated as the network itself. In enterprise mode the client presents
its identity to a central server, and who that server is becomes a separate question.

If the client does not verify the server's identity and trust root, this claim has no proof at
all. The table states this plainly: that row is empty in the middle column. Enterprise mode,
when not configured correctly, loses even personal mode's one proof, and gains in exchange a
server whose identity must be presented. When the trust root is fixed, seven of seven claims are
tied to proof; when it is not fixed, the number of open claims drops to one, but the claim that
stays open is the **most expensive one**. The next lesson will measure what it means for that
claim to stay open.

The last section counts the cost. Enterprise mode brings seven additional infrastructure items,
and these items are touched by hand twenty-nine times a year. The most frequently touched item is
the identity revocation list; the most critical one is the trust root, because when it is
renewed, every client profile must be renewed with it.

The device side limits the decision. Three of the six roles support enterprise mode; the
remaining three classes, four thousand one hundred thirty-eight devices, must stay in personal
mode. Most of these are meter endpoints, and each connects to a single item, the aggregator
ingress. This means the move to enterprise mode is a partial move: roles with subjects go to
enterprise mode, subjectless devices go to personal-mode networks split per role. The measurement
supports this split — the average item count opened for all four thousand one hundred
thirty-eight devices is already one.

## Summary

- In personal mode, a single network and a single secret open all twelve items; splitting the
  network per role brings the average down to 2.5 items, the same separation enterprise mode
  gives. Enterprise mode is not required for item separation.
- The separation is not free: in personal mode, changing a secret touches every device on that
  network (16,400 minutes on the most crowded network); in enterprise mode a single identity is
  revoked (0 minutes, 0 devices). The number of trust roots to manage climbs from 1 to 4,400.
- A departing subject requires touching 393 devices in personal mode; 37 annual departures cost
  58,164 minutes. Because this cost is not paid, the secret is not changed, and the string the
  departed subject knew stays on the network.
- Enterprise mode ties six of seven claims to proof but **adds** a claim: that the other party is
  the organization's authentication server. If the trust root is not fixed, that claim has no
  proof.
- The cost is seven additional infrastructure items and twenty-nine manual touches a year; three
  of six roles, 4,138 devices, cannot support enterprise mode and stay in personal mode.

## Next Step

This lesson put the trust root in place and left one row of the table open: whether the client
verifies who the other party is. What it means for that row to stay empty is not a configuration
detail. When a client decides to connect to a network, all it has is the announcements that
network makes about itself — this is exactly the network name claim that stayed unproven in all
four generations in the first lesson's table. The next lesson's question is: what does a client
look at to accept a network's identity, how many of those signals carry proof, how many paths
does a saved network profile open by itself, and how many of those paths does mutual
authentication close.