Lecture Notes: Authentication, Authorization, and Accounting (AAA) Framework

Introduction to AAA

• Identification:
  • Process begins when you claim to be a particular user on a system.
• Authentication:
  • Verifies your identity through username, password, and additional authentication factors.
  • Proves your identity by knowing the password or having other factors.
• Authorization:
  • Determines the type of access you have after authentication.
  • Example: Access for shipping vs. finance department.
• Accounting:
  • Logs the activities: login time, data transfer, and logout time.

Practical Example of AAA in a VPN Setup

• VPN Access Process:
  • User accesses VPN concentrator with a username and password.
  • VPN concentrator checks credentials with a central AAA server.
  • AAA server verifies the credentials and sends approval.
• Role of AAA Server:
  • Stores all authentication credentials and information centrally.
  • Handles requests from devices like VPN concentrators.

Device Authentication

• Challenge of Device Authentication:
  • Devices can’t type passwords; storing passwords on devices is not ideal.
• Use of Certificates:
  • Certificates used for device authentication, digitally signed by a Certificate Authority (CA).
  • Ensures device authentication during the login process.
• Certificate Authority (CA):
  • Manages the certificates and digitally signs them.
  • Provides certificates that prove the legitimacy of devices.

Authorization Models

• Authorization Challenge:
  • Scaling access control for thousands of users and resources.
• Role-based Access Control (RBAC):
  • Users are grouped based on roles (e.g., shipping and receiving).
  • Roles have defined access to resources, simplifying user management.
• Example of RBAC in Practice:
  • Users in the shipping and receiving group gain access to relevant systems and data.
  • Easy scaling by adding users to the group instead of managing individual permissions.

Benefits of Using an Authorization Model

• Scalability:
  • Efficiently manage large numbers of users and resources.
  • Abstract users from direct access to resources.
• Simplification:
  • Streamline administration and resource management.
  • Use of groups and roles to simplify permissions and access control.

Conclusion:

• AAA framework is essential for securing systems by ensuring proper authentication, authorization, and accounting.
• Use of digital certificates and authorization models (like RBAC) aids in scalable and effective security management.