Tutorial 3.15: Internet Authentication Applications

Learning Objectives

After completing this tutorial, you should be able to:

• Explain the role of network authentication protocols in providing AAA services.
• Describe the RADIUS architecture, including clients, servers, and proxies.
• Analyze RADIUS message formats, attribute types, and operations.
• Evaluate the use of RADIUS in enterprise wireless authentication (802.1X).
• Describe the TACACS+ architecture and its features.
• Compare and contrast RADIUS and TACACS+.
• Explain the Diameter protocol and its role in AAA.
• Compare RADIUS and Diameter.
• Design an authentication solution for a given network scenario.

Overview

In the previous tutorials, we have explored authentication protocols for user access to systems and applications— Kerberos for enterprise networks, SAML and OIDC for web-based federation. However, authentication is not limited to user-to-application interactions. Network infrastructure itself—routers, switches, firewalls, VPN gateways, and wireless access points—requires robust authentication mechanisms to control access and manage administrative sessions. This tutorial focuses on the Internet Authentication Applications that provide Authentication, Authorization, and Accounting (AAA) services for network access: RADIUS, TACACS+, and Diameter.

These protocols are foundational to network security. They enable centralized management of authentication and authorization policies, allowing organizations to enforce consistent security controls across diverse network infrastructure. Without these protocols, network administrators would need to manage credentials and permissions on each device individually—a task that quickly becomes unmanageable in any organization of significant size.

We begin with RADIUS (Remote Authentication Dial-In User Service), the most widely deployed AAA protocol. Developed in the 1990s for dial-up access, RADIUS has evolved to support a broad range of network access scenarios, including VPNs, wireless (802.1X), and switch/router management. We examine its architecture, message formats, attribute types, and authentication methods (PAP, CHAP, EAP). We also discuss RADIUS proxying and its use in enterprise wireless authentication.

We then explore TACACS+ (Terminal Access Controller Access Control System Plus), a Cisco-developed protocol that provides separate authentication, authorization, and accounting services. TACACS+ is primarily used for network device administration (e.g., router and switch access). We analyze its architecture, message exchange, and key features—including the separation of AAA functions and encryption of the entire payload—and compare it with RADIUS.

We then examine Diameter, a more recent protocol designed to address the limitations of RADIUS, particularly in mobile and IP multimedia environments. Diameter is used in LTE/5G networks, IP Multimedia Subsystems (IMS), and by many large-scale service providers. We discuss its architecture, applications, and how it improves upon RADIUS.

The tutorial concludes with case studies illustrating the use of RADIUS in enterprise wireless networks, TACACS+ for network device administration, and Diameter in a mobile telecommunications environment. By the end of this tutorial, you will have a comprehensive understanding of the protocols that secure network infrastructure access.

1. Introduction to Internet Authentication Applications

1.1 What Are Internet Authentication Applications?

Internet Authentication Applications are protocols that provide AAA (Authentication, Authorization, and Accounting) services for network access. They enable centralized management of user access to network resources, ensuring that only authorized users and devices can connect to the network, and that their activities are logged for audit and billing purposes.

The three primary protocols in this domain are:

• RADIUS: The most widely deployed AAA protocol, used for network access (dial-up, VPN, wireless, switch/router authentication).
• TACACS+: A Cisco-developed protocol for device administration, offering separate AAA functions and encryption.
• Diameter: A newer protocol that extends and improves upon RADIUS, used in mobile (LTE/5G) and IP multimedia systems.

1.2 The AAA Framework in Network Access

• Authentication: Verifying the identity of a user or device trying to access the network.
• Authorization: Determining what resources the authenticated user can access (e.g., VLAN, privilege level, QoS).
• Accounting: Logging the user's activities—session duration, data usage, commands executed—for billing, auditing, and troubleshooting.

1.3 Centralized vs. Distributed Authentication

Without a central AAA system, each network device (router, switch, access point) must maintain its own user database. This is difficult to manage, inconsistent, and insecure. Centralized AAA, using protocols like RADIUS and TACACS+, allows organizations to manage authentication policies from a single server, improving security and operational efficiency.

2. RADIUS – Remote Authentication Dial-In User Service

2.1 Overview

RADIUS (Remote Authentication Dial-In User Service) is a networking protocol that provides centralized AAA services for users who connect to a network. It was originally developed by Livingston Enterprises for dial-up PPP access and later standardized in RFC 2865 (Authentication) and RFC 2866 (Accounting). RADIUS is widely used for VPN, wireless (802.1X), and network device authentication.

2.2 RADIUS Architecture

• RADIUS Client: A network device (NAS – Network Access Server, wireless access point, VPN gateway) that initiates authentication requests on behalf of users. The client forwards user credentials to the RADIUS server.
• RADIUS Server: A central server that authenticates users, authorizes access, and returns configuration information (e.g., VLAN, IP address). It stores user credentials (often in a database or LDAP).
• RADIUS Proxy: An intermediary that forwards RADIUS messages between clients and servers, often used in multi-domain or roaming environments.

Figure 1: RADIUS architecture with client (NAS), server, and backend database.

2.3 Authentication Methods

RADIUS supports various authentication methods, which are negotiated between the client and server:

• PAP (Password Authentication Protocol): The password is sent in cleartext (in the Access-Request packet) but is protected by the RADIUS shared secret. PAP is weak.
• CHAP (Challenge-Handshake Authentication Protocol): The server sends a challenge; the client responds with a hash of the challenge and password. More secure than PAP.
• EAP (Extensible Authentication Protocol): Allows for flexible authentication methods, including certificates, tokens, and biometrics. Used in 802.1X wireless and wired authentication.

2.4 RADIUS Security

• Shared Secret: A pre-shared key between the RADIUS client and server. Used to encrypt the password (in PAP) and to authenticate messages.
• Message Integrity: The RADIUS Access-Response includes a signature (MD5-based) to verify authenticity.
• Encryption: Only the user password is encrypted (in PAP mode); other attributes are sent in cleartext. RADIUS does not encrypt the entire payload by default.
• Limitations: RADIUS uses UDP, which is connectionless and does not guarantee delivery. It also does not provide message-level confidentiality for all attributes.

3. RADIUS Messages and Attributes

3.1 RADIUS Message Structure

A RADIUS message consists of a header and a variable number of attributes.

• Code: Message type (e.g., 1 = Access-Request, 2 = Access-Accept, 3 = Access-Reject, 4 = Accounting-Request).
• Identifier: Used to match requests and responses.
• Length: Total length of the message.
• Authenticator: Used for authentication and message integrity.
• Attributes: Variable-length fields carrying specific data.

3.2 Common RADIUS Attribute Types

3.3 RADIUS Proxy

RADIUS supports proxying, where a RADIUS client forwards requests to a RADIUS proxy, which then forwards them to a RADIUS server. This is useful in scenarios like:

• Roaming: Users from different ISPs can authenticate using their home credentials.
• Federation: Multiple organizations share a common RADIUS infrastructure.
• Load balancing: Distributing authentication requests across multiple servers.

4. RADIUS Operations and Network Access

4.1 Authentication Flow

4.2 802.1X and Enterprise Wireless Authentication

In enterprise Wi-Fi networks, RADIUS is used with 802.1X (Port-Based Network Access Control). The typical flow is:

• Supplicant: The client device (laptop, phone).
• Authenticator: The access point (wireless controller).
• Authentication Server: The RADIUS server (often with EAP).

The access point acts as a RADIUS client, forwarding EAP messages from the supplicant to the RADIUS server. The RADIUS server performs the authentication (e.g., using EAP-TLS, PEAP, or EAP-MSCHAPv2) and sends an Access-Accept or Access-Reject. This provides strong, centralized authentication for wireless networks.

4.3 RADIUS Accounting

RADIUS accounting messages (Accounting-Request, Accounting-Response) are used to track user sessions. Accounting attributes include:

• Acct-Status-Type: Start, Stop, Interim-Update.
• Acct-Session-Id: Unique session identifier.
• Acct-Input-Octets / Acct-Output-Octets: Data transferred.
• Acct-Session-Time: Duration of the session.

5. TACACS+ – Terminal Access Controller Access Control System Plus

5.1 Overview

TACACS+ (Terminal Access Controller Access Control System Plus) is a Cisco-developed protocol that provides AAA services for network device administration (e.g., router, switch, firewall access). Unlike RADIUS, TACACS+ separates the three AAA functions (Authentication, Authorization, Accounting) into independent services, providing greater flexibility. It also encrypts the entire packet payload, not just the password.

5.2 Architecture

• TACACS+ Client: A network device (router, switch, firewall) that sends authentication, authorization, and accounting requests to the TACACS+ server.
• TACACS+ Server: A central server that provides AAA services. It stores user credentials and policies.

TACACS+ uses TCP (port 49) for reliable communication, unlike RADIUS which uses UDP.

5.3 TACACS+ Features

• Separate AAA: Authentication, authorization, and accounting are independent services. This allows different methods for each (e.g., LDAP for authentication, local database for authorization).
• Full Packet Encryption: The entire TACACS+ payload is encrypted, providing confidentiality for all attributes (including username and password).
• Granular Authorization: TACACS+ provides fine-grained authorization for commands. For example, a user can be allowed to use certain router commands but not others.
• Reliable Transport: TCP ensures reliable delivery and connection-oriented sessions.

5.4 TACACS+ Message Exchange

TACACS+ uses a three-phase negotiation:

1. Start: Client sends a START message indicating the service (e.g., login).
2. Continue: Server sends a response (e.g., challenge); client responds with credentials.
3. Finish: Server sends a PASS or FAIL message.

This process is similar to a challenge-response, but the messages can be encrypted. TACACS+ also supports an "authorization only" mode, where the client requests authorization for a specific command.

6. TACACS+ Message Structure

6.1 TACACS+ Header

• Major/Minor Version: Protocol version.
• Type: Message type (1 = Authentication, 2 = Authorization, 3 = Accounting).
• Sequence: For session management.
• Flags: Encryption and compression flags.
• Length: Length of the body (following the header).

6.2 TACACS+ Body

The body contains the actual AAA data. For authentication, it includes fields like username, password, and remote address. For authorization, it includes the command to be authorized. For accounting, it includes session details. The body is encrypted using a key derived from the shared secret, providing confidentiality.

7. Comparison: RADIUS vs. TACACS+

8. Diameter Protocol

8.1 Overview

Diameter is a AAA protocol designed to overcome the limitations of RADIUS. It was developed by the IETF and standardized in RFC 6733 (Diameter Base Protocol). Diameter is used primarily in mobile networks (LTE/5G), IP Multimedia Subsystems (IMS), and by large-scale service providers. It provides a more robust, extensible, and scalable framework than RADIUS.

8.2 Architecture

• Diameter Node: An entity that implements the Diameter protocol. Nodes can be clients, servers, or relay/agents.
• Diameter Client: A network device (e.g., access point) that sends authentication/authorization requests.
• Diameter Server: The central AAA server.
• Diameter Agents: Intermediate nodes that relay, redirect, or proxy messages (e.g., Relay Agents, Proxy Agents).
• Realm: A logical domain of Diameter nodes.

8.3 Key Features

• Reliable Transport: Diameter uses TCP (or SCTP) for reliable, connection-oriented communication.
• Message Integrity and Confidentiality: Diameter supports TLS and IPsec for security.
• Peer-to-Peer: Diameter nodes establish peer relationships, allowing for more flexible topologies.
• Extended Attribute Space: Unlike RADIUS (which uses 8-bit attribute types), Diameter uses 32-bit AVPs (Attribute-Value Pairs), allowing for a much larger set of attributes.
• Stateful Sessions: Diameter supports session state, enabling features like session management and re-authentication.
• Capability Negotiation: Diameter nodes negotiate capabilities during peer establishment.
• Error Handling: Detailed error codes and reporting.

8.4 Diameter Applications

Diameter is extended through "applications" that define specific message sets and AVPs for particular use cases:

• Diameter Mobile IPv4 Application: For Mobile IPv4.
• Diameter EAP Application: For EAP authentication.
• Diameter Credit-Control Application: For real-time billing.
• Diameter SIP Application: For IMS/SIP authentication.
• Diameter 3GPP Applications: Various applications for LTE/5G networks (e.g., S6a, S9, Gx).

9. Comparison: RADIUS vs. Diameter

10. Case Studies and Real-World Applications

10.1 Case Study: Enterprise Wireless Authentication with RADIUS

Background: A large university with 30,000 students and 5,000 staff deploys a campus-wide Wi-Fi network using 802.1X and RADIUS.

Architecture:

• RADIUS servers (redundant) using FreeRADIUS with an LDAP backend.
• Wireless controllers act as RADIUS clients.
• EAP-PEAP with MSCHAPv2 for client authentication.
• RADIUS accounting logs session data for audit and capacity planning.

Outcome: Students and staff authenticate using their university credentials. The network provides secure, authenticated access with centralized management.

10.2 Case Study: Network Device Administration with TACACS+

Background: A financial services company manages hundreds of routers, switches, and firewalls. They need fine-grained control over who can access these devices and what commands they can execute.

Solution:

• TACACS+ server (Cisco ISE) for AAA.
• Different privilege levels: Read-Only, Read-Write, and Administrator.
• Command authorization: Specific commands (e.g., "reload", "configure") require additional authorization.
• Accounting logs all commands executed for audit.

Outcome: The company achieves strict control over network device access, with detailed audit trails for all administrative actions.

10.3 Case Study: Diameter in 5G Networks

Background: A mobile network operator (MNO) deploys a 5G network. The core network uses Diameter for AAA services, including subscriber authentication (S6a interface between MME and HSS).

Architecture:

• Diameter servers (HSS/UDM) store subscriber profiles.
• Diameter clients (MME) authenticate subscribers during attach procedures.
• Diameter agents (DRA – Diameter Routing Agent) route messages.
• Diameter supports roaming and inter-operator communication.

Outcome: Diameter provides secure, reliable, and scalable AAA for millions of subscribers, supporting the complex requirements of 5G networks.

11. Summary and Transition

This tutorial provided a comprehensive exploration of Internet Authentication Applications—the protocols that secure network infrastructure access. We began by introducing the AAA framework and the need for centralized authentication in networks. We then examined RADIUS, the most widely deployed network AAA protocol, covering its architecture, messages, operations, and use in enterprise wireless (802.1X). We explored its security model, including shared secrets and encryption limitations.

We then examined TACACS+, a Cisco-developed protocol for device administration, highlighting its separation of AAA functions, full payload encryption, and granular command authorization. We compared RADIUS and TACACS+, showing how each is suited to different use cases—RADIUS for network access, TACACS+ for device administration.

Finally, we explored Diameter, a more modern protocol that overcomes many of RADIUS's limitations, offering reliable transport, full encryption, session state, and extensibility. Diameter is used in mobile networks (LTE/5G), IP multimedia systems, and large-scale service provider environments.

The case studies illustrated the real-world application of these protocols: RADIUS in university wireless networks, TACACS+ in enterprise network administration, and Diameter in 5G networks.

This tutorial has equipped you with a comprehensive understanding of the protocols that secure network infrastructure access. In the next tutorial, Tutorial 3.16, we will explore OAuth, OpenID Connect, and Modern Identity Systems, delving deeper into the protocols that underpin modern web authentication and federation.

Quiz

Answer the following questions to check your understanding. Click the "Answer" button to reveal the solution.

Exercises

These exercises are designed to help you apply the concepts from this tutorial. Attempt each exercise before revealing the sample solution.

Homework

These homework questions require deeper analysis, research, and application. Answer each question comprehensively.

Summary

This tutorial provided a comprehensive exploration of Internet Authentication Applications—the protocols that secure network infrastructure access. We began by introducing the AAA framework and the need for centralized authentication in networks. We then examined RADIUS, the most widely deployed network AAA protocol, covering its architecture, messages, operations, and use in enterprise wireless (802.1X). We explored its security model, including shared secrets and encryption limitations.

We then examined TACACS+, a Cisco-developed protocol for device administration, highlighting its separation of AAA functions, full payload encryption, and granular command authorization. We compared RADIUS and TACACS+, showing how each is suited to different use cases—RADIUS for network access, TACACS+ for device administration.

Finally, we explored Diameter, a more modern protocol that overcomes many of RADIUS's limitations, offering reliable transport, full encryption, session state, and extensibility. Diameter is used in mobile networks (LTE/5G), IP multimedia systems, and large-scale service provider environments.

The case studies illustrated the real-world application of these protocols: RADIUS in university wireless networks, TACACS+ in enterprise network administration, and Diameter in 5G networks.

This tutorial has equipped you with a comprehensive understanding of the protocols that secure network infrastructure access. In the next tutorial, Tutorial 3.16, we will explore OAuth, OpenID Connect, and Modern Identity Systems, delving deeper into the protocols that underpin modern web authentication and federation.

© 2026 COMP400 – Computer and Network Security • School of Computing and Information Systems, TrustOpen University • Unit 3: Authentication and Access Control