The core capabilities of the network access certification system can be broken down into three levels: authentication, authorization, and access. Many units have only built access systems."Authentication"I'm doing it right, but I'm here."Delegation of authority"and"Access"The vagueness of the language has resulted in a system that has reduced security. Separated these three dimensions is fundamental to the value of network access certification systems. This piece provides insight into authentication, authorization, and access to each of the three levels.
Authentication level: Answer"Who are you, whose equipment you own?"
The certification level is the first level of access control."Can you trust the accessor's identity?"problem. It's two things: the identity of a person, through account codes, certificates, text-letter authentication codes, multiple factor authentication, etc."Who are you?"; second, equipment identification, confirmed through a MAC address, certificate, device fingerprint, etc."Is your equipment registered?"The authentication level is ready to make sure that it's all online."Known person, registered equipment". The authentication method is selected by scenario and risk stratification, regular office account number plus insulation, high-security area with multiple factors, not a single ruler.
Authorized level: Answer"What can you visit, what can't interview."
The authorization layer is the most vulnerable link to many access projects and the key to determining safety effects."It's online."Doesn't mean"It's all about everything."The delegation of authority level is to issue differentiated access rights based on the user’s role, department, region and time: ordinary staff have access to day-to-day office resources, sensitive jobs like finance, personnel, etc. are able to access corresponding business systems, visitors can only access Internet and designated resources, and server areas are open only to operators."Who can interview what?"The government has been working on the issue of Internet access.
Access level: answer"How did you get in here? Where did you get in there?"
Access level is responsible for putting authentication and authorization decisions on real network actions. Once authentication and authorisation are completed, access layer guides network equipment to implement the corresponding access action: assigns users to the right VLAN, sends corresponding ACLs, controls user access, and separates non-compliant terminals from repair networks if necessary. Access layer usually requires connection with switches, wireless controllers, ACs, firewalls, sending access decisions to network devices through protocols such as Radius, Portal, SNMP, etc."Security on paper."。
Relationship between the three layers: certification is a prerequisite, authorization is at the core and access is landing
Authentication, authorization, access are not three separate functions but a complete chain. The authentication process is only done by talking about the authorization and confirming it. The entire link is disabled if any of the links are broken: authentication is invalid; permission is invalid; access to the network is flawed; access is ineffective and the strategy is out of order. When building the network access certification system, you have to design from these three layers as a whole, rather than just focus on the authentication function. Access controls are truly managed."Who, what can you access, how do you get in?"。
Common error area: authentication only without authorization
A lot of access projects are not working as well. The root is to equate access with simple access."Login authentication". After authentication, all users have the same access rights and access to the same network, which is equal to only doing it"Restricted."I didn't do it."Division"The real access control must have a level of authorization."By role, by region, by strategy"Differential release. The selection focuses on the system ' s enabling capacity: role and strategy models are flexible, distributed by region and time frame, and access to network equipment is a safe place for them.
The value of network access to the certification system is that it"Authentication, authorization, access"The three levels are connected. Authentication is credible, access to borders is authorized, and access solutions strategies are in place."Know who gets in, controls what you can access, drops on the network.", instead of remaining on the login page.