It seems counterintuitive that a cybersecurity framework developed in the 1970s is arguably more needed now than ever to secure modern enterprises. But that’s exactly the case with public key infrastructure (PKI).
In this guide to public key infrastructure authentication, we’ll dive into what PKI authentication is, how PKI authentication works, and the benefits of using PKI authentication.
What Is PKI?
Before diving into PKI authentication, it’s important to first understand public key infrastructure (PKI).
Put simply, PKI is a framework of certificate authorities (CAs), registration authorities (RAs), key management systems, policies, and validation mechanisms that issue, validate, and revoke digital certificates.
Perhaps without even realizing it, you likely interact with PKI daily, such as when connecting to a website, where your browser leverages PKI to verify that a website can be trusted before engaging in encrypted communication.
What Is PKI Authentication?
As the name suggests at a high level, PKI authentication is the process of verifying users and/or devices by leveraging public key infrastructure (PKI). PKI authentication is asymmetric cryptographic identity verification based on certificate trust chains.
But when you dig a little deeper, the name can be a bit misleading, as PKI relies on both public and private keys. A certificate binds a public key to an identity and is digitally signed by a trusted CA. Authentication occurs when the certificate chain and proof-of-private-key possession are validated.
For enterprises, PKI authentication is important today for securing Wi-Fi or other network access using 802.1X authentication, rather than just relying on usernames and passwords.
In particular, as the number of devices grows, such as in BYOD environments and with the proliferation of Internet of Things (IoT) devices, it’s important to have a framework that helps ensure the right users and devices are connecting to your network.
How PKI Authentication Works
PKI authentication relies on certificates to prove identity, such as that of a user, device, or website. In that sense, a certificate is like a driver’s license used as ID. But just as there are parties and processes behind issuing driver’s licenses and authenticating them, the same goes for digital certificates.
So, with PKI authentication, the main steps and parties involved include the following:
- Certificate issuance: First, you need a trusted party to issue certificates. This could be a third-party known as a certificate authority (CA), which is often used in the context of website certificates. But within a corporate network, you might have an internal CA that’s used to issue certificates to each device you want to grant access to.
- Public and private key generation: Generally, to get a certificate issued, a public and private key are first generated by the relevant device/software/site/etc. that will need to prove its identity. That party then sends the public key to the CA while hanging onto the private key in a secure storage location, such as a TPM (Trusted Platform Module) on a computer. (So, steps 1 and 2 are somewhat out of order here, but they’re intertwined).
- Authentication request: This is the meat of the PKI authentication process. When trying to access a protected resource — like a laptop connecting to a corporate Wi-Fi network that relies on 802.1X certificate-based authentication instead of just a password — the laptop needs to prove its identity. In this case, a RADIUS server generally requests the certificate from the laptop and checks the certificate against its trusted CA.The certificate also contains the public key. As part of the authentication process, the server also issues a cryptographic challenge that the laptop signs using its private key. The server then verifies this cryptographic math by using the public key to verify that the challenge was signed by the owner of the aligned private key.
If the authentication request goes through successfully, then the device can connect to the network/website/etc., often via TLS (Transport Layer Security). PKI authentication in EAP-TLS occurs within the TLS handshake itself. TLS is an encryption protocol, such as for moving data between a VPN and corporate network.
Technically, this encryption is not PKI authentication. But PKI authentication gives the green light to start an encrypted connection, with the public and private key used to exchange a session key. As such, PKI is considered essential for modern encryption.
PKI Authentication Benefits
Because PKI validation is based on cryptography, it’s inherently more secure than password-based authentication, which can easily be intercepted or cracked.
So, PKI authentication can make it safer and more practical for enterprises to:
Manage BYOD Environments
Many companies allow employees to use their personal devices for work, especially smartphones that might supplement a work-issued computer. While that can add convenience, it can also introduce new security risks, as you don’t want any random device to be able to connect to your network.
So, to let BYOD devices connect securely, companies can use PKI authentication, where enrolled devices get issued device-specific certificates. When those devices try to connect to the corporate network, PKI authentication means they cryptographically prove they’re in possession of the private key that verifies the certificate’s legitimacy.
And if the device gets stolen or other security issues pop up, enterprises can use software like SecureW2 that makes it easy to dynamically revoke certificates.
Implement 802.1X Network Access
Under 802.1X, the supplicant authenticates through an authenticator (switch/AP), which forwards EAP messages to a RADIUS authentication server. And the gold standard for 802.1X authentication uses EAP-TLS, which relies on PKI authentication.
With EAP-TLS, the device proves its identity via a certificate and a mutual TLS handshake, which, as mentioned, is initiated via the cryptographic proof stemming from PKI.
Simplify PKI Authentication with SecureW2
PKI authentication helps improve security, but it can be challenging to manage certificates, especially if you’re trying to scale device connections and adapt to security threats.
SecureW2 simplifies this through an integrated platform that includes aspects such as a cloud RADIUS server and dynamic PKI management system. The cloud RADIUS server validates certificates against the trusted CA and revocation sources in real-time rather than relying on whenever the server was last manually updated.
Ultimately, SecureW2 enables you to move to a zero-trust architecture based on PKI authentication, without the operational complexity that can otherwise be associated with this framework.
Schedule a demo of SecureW2’s passwordless platform today to see how it can save you time while strengthening security.
