AAA Framework Flashcards

Claiming an identity — e.g. typing a username. System records the claim but does NOT verify it yet.

PROVING your claimed identity is legitimate. Via password, biometric, smart card, certificate, or MFA.

After authentication: what are you ALLOWED to access? Defines permissions based on roles, attributes, or policies.

Tracking what authenticated users DID. Login/logout times, data transferred, session duration. Creates audit logs.

Multi-Factor Authentication — requires 2+ factors: something you KNOW (password), HAVE (token/device), or ARE (biometric).

Trusted entity that creates and signs digital certificates. Organizations often run their own CA to authenticate devices without passwords.

Centralized AAA server protocol. VPN concentrators pass credentials to RADIUS for validation. RADIUS stores all user/device credentials.

Device that manages VPN connections. Receives login requests and passes them to the AAA server. Does NOT store credentials itself.

An abstraction layer between users and resources. Users assigned to roles/groups, which have defined permissions. Replaces direct user-to-resource mapping.

Role-Based Access Control. Permissions assigned to roles; users assigned to roles. Adding a user to a role instantly grants all role permissions.

The intermediate layer (role/group) between users and resources. Separates identity from access rights. Makes large-scale management feasible.

Login time, logout time, session duration, data sent, data received. NOT financial accounting — IT audit logging.

Systems can't type passwords, and storing passwords on field devices creates security risks. Solution: install a CA-signed digital certificate on the device instead.

Authentication = WHO are you? (identity verification). Authorization = WHAT can you do? (access rights). Authentication always comes first.

Direct user-to-resource mapping doesn't scale. Hard to audit, hard to manage. Adding one user requires setting individual permissions for every resource they need.

The AAA server (e.g., RADIUS), NOT the VPN concentrator itself. The concentrator passes credentials to RADIUS and waits for the approve/deny response.