Then, based on the method used, they will enter that key into a separate piece of hardware, or they will use a software package to enter the challenge key. Both the hardware system and the software system will provide a unique response key to the challenge. The Public class is only accessing via HTTP, so no password is required here. Figure 3 shows what our authentication matrix will look like. The next issue to consider is access control.
Access control determines when and how to permit access.
This allows for finer grains of isolation of access to the internal network. In the example, inbound access from employees is permitted only during non-working hours. Vendors are allowed access only during working hours. Consultants may Telnet only during working hours, but can FTP at any time. These rules are not uncommon.