Network Authentication Protocols
Tags: security, protocols, authentication, authorization
Published: 2022-08-16 18:23:00

Authentication keeps invalid users out of databases, networks, and other resources. 
**Authentication Protocols** are well defined, industry standard ways to validate the identity of remote clients/users (_Authentication_) before granting them access to server data (_Authorization_) and in monitoring network resources and information needed for billing of services (_Accounting_).

Different Authentication Protocols used to validate users are PAP, CHAP, Oauth 2, TACACS+, RADIUS, Kerberos, SAML, LDAP/Active Directory etc. These can be used simultaneously for different purpose.

**Password authentication protocol (PAP):** 
It is one of the oldest authentication protocols deprecated now, yet used sometimes.
In PAP, system _compares user credentials_ (username and password) to a database to validate. Since there is no encryption, it is least secure.

**Challenge-Handshake Authentication Protocol (CHAP):** 
CHAP _periodically reauthenticates_ users identity using a 3-way handshake. Each challenge is different from last version and verification is done even within the same session.

**Extensible authentication protocol (EAP)**: 
_Wireless_ networks and _point-to-point_ connections uses EAP. 

**Kerberos**: 
Kerberos uses symmetric keys between client-server (secret-key cryptography), pulled from a centralized key distribution center known as _Key Distribution Center (KDC)_. 
There are few drawbacks viz, the process is time-sensitive, so devices using the Kerberos must have relatively well-synced clocks. Also, it not advised to use this protocol for networks heavy on virtual hosting because every host requires its own set of Kerberos keys.
Further, in 2020, Kerberos stopped working after a system update.

**Lightweight Directory Access Protocol (LDAP)**: 
The Lightweight Directory Access Protocol is an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an _Internet Protocol (IP) network_.

Organizations using LDAP stores information like user credentials (usernames, passwords), email addresses, printer connections and other static data within directories. 
LDAP works by binding an _LDAP user_ to an LDAP server. 
The client sends an operation request that asks for a particular set of information, such as user login credentials or other organizational data. 
The _LDAP server_ then processes the query based on its internal language, communicates with directory services if needed, and responds. 
When the client receives the response, it unbinds from the server and processes the data accordingly.

LDAP is the underlying protocol for directory services and is leveraged in _Directory-as-a-Service (DaaS)_, a cloud-based software-as-a-service (SaaS) user directory.

**OAuth 2.0**:
OAuth 2 is a way for users to allow websites and mobile apps to access their credentials without giving them the passwords, implemented by various sites viz Google, Facebook, Twitter etc. OAuth 2 works with _HTTP_. It provides _access tokens_ to be applied to a third-party with the permission of the resource owner.
One of the possible security risk with OAuth 2 is that it uses one account for multiple applications, so, if the main account is ever compromised, users risk compromising many more instances. Such an issue was faced by GitHub in 2020. 

**Remote authentication dial-in user service (RADIUS)**: RADIUS system verifies credentials (username-password) provided by client by comparing it to data in a database. RADIUS provides centralized authentication, authorization, and accounting (AAA or Triple A) management. 
In RADIUS,
_Authentication_ data flows from NAS (Network Access Server) to RADIUS server in Access-Request packets.
_Authorization_ data flows from the RADIUS server to NAS in Access-Accept, Access-Reject, CoA-Request, and Disconnect-Request packets.
_Accounting_ data flows from the NAS to the RADIUS server in Accounting-Requests.

**Diameter** is derived from RADIUS and provides a framework for authentication and accounting messages. 
It is a _Peer-to-Peer (P2P)_ protocol. Peers can be statically configured or dynamically discovered.
Extensibility is an important trait of the Diameter protocol. It supports a modular architecture with the base protocol and application-specific extensions. 

There are many other efficient and widely used authentication protocols like _SAML_ (XML based protocol), _TACACS_ (IP-based authentication), it's enhanced versions and various others.

<u>Reference</u> :

[datatracker.ietf.org](https://datatracker.ietf.org/doc/html/rfc1334)
[frontegg.com](https://frontegg.com/blog/authentication#API-Authentication-Methods)
[auvik.com](https://www.auvik.com/franklyit/blog/authentication-protocols/)
[sailpoint.com](https://www.sailpoint.com/identity-library/authentication-methods-used-for-network-security/)
[okta.com](https://www.okta.com/identity-101/authentication-protocols/)
[getkisi.com/blog](https://www.getkisi.com/blog/authentication-protocols-overview)
[jumpcloud.com](https://jumpcloud.com/daas-glossary/directory-as-a-service-daas)
[stackoverflow.com](https://stackoverflow.com/a/37707516)
[Wikipedia - Authentication Protocol](https://en.wikipedia.org/wiki/Authentication_protocol)
[Wikipedia - PPP](https://en.wikipedia.org/wiki/Point-to-Point_Protocol)
[Wikipedia - LDAP](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol)