RADIUS

RADIUS
Name	RADIUS
Acronym	RADIUS
Introduced	1991
Developer	IETF
Type	Authentication, Authorization, Accounting
Port	1812, 1813

RADIUS is a networking protocol that provides centralized Authentication, Authorization, and Accounting services for users who connect and use a network service. It originated as a solution for remote access systems and has been widely adopted across telecommunications, campus networking, corporate LANs, and ISP infrastructures. RADIUS interworks with a range of access devices, directory services, billing systems, and security frameworks in production deployments.

History

RADIUS was developed in the early 1990s to address remote access needs arising from deployments by Cisco Systems, Bell Labs, and early Internet service providers such as PSINet and UUNET. Early standardization work took place in the Internet Engineering Task Force with contributions from vendors and operators associated with DARPA research and commercial dial-up networks. Over time RADIUS evolved alongside authentication technologies like Kerberos, directory services such as Active Directory and OpenLDAP, and accounting systems implemented by telco and ISP firms including AT&T and Verizon. Subsequent updates and track work in the IETF influenced refinements that paralleled developments in networking protocols such as PPP and 802.1X.

Protocol Overview

RADIUS operates as a client–server protocol where Network Access Servers (NAS) or access points act as clients and forward request messages to RADIUS servers such as those developed by Cisco Systems, FreeRADIUS, or commercial products from Microsoft and Juniper Networks. The protocol typically uses UDP transport on ports 1812 for authentication and 1813 for accounting, though some deployments use legacy ports associated with RFC 2865 and RFC 2866. RADIUS messages contain attributes that encode identity, credentials, session parameters, and usage metrics, interoperating with identity stores like LDAP, authentication databases managed by Oracle Corporation or MySQL, and external policy engines used by organizations such as RSA Security.

Authentication and Authorization Mechanisms

Authentication in RADIUS commonly leverages shared secrets between NAS devices and RADIUS servers and supports authentication methods including PAP, CHAP, and EAP types standardized with input from EAP working group contributors and vendors like Microsoft and Cisco Systems. EAP integration enables use of credential systems based on certificates issued by certificate authorities such as DigiCert or Let’s Encrypt, and supports transport-layer interactions with systems using 802.1X for port-based network access control in enterprise campuses like those run by IBM or Google. Authorization decisions may be driven by policy engines linked to identity directories such as Active Directory or OpenLDAP, or by bespoke rule sets developed for service providers like Sprint and T-Mobile.

Message Types and Packet Format

RADIUS defines a set of message types including Access-Request, Access-Accept, Access-Reject, Accounting-Request, Accounting-Response, and Access-Challenge; these types are specified in documents produced by the Internet Engineering Task Force. Packets include a fixed header with fields for code, identifier, length, and an authenticator, followed by Type-Length-Value (TLV) attributes that can reference vendor-specific extensions from companies like Cisco Systems, Juniper Networks, and Huawei. Attribute dictionaries have been published by vendors and open-source projects such as FreeRADIUS and standardized attribute numbers are maintained in IETF registries used by implementations from Microsoft and Oracle Corporation.

Security Considerations

RADIUS security relies on shared secrets and the use of MD5-based authenticators for integrity and replay protection in legacy variants; this approach has been critiqued in security analyses from organizations such as NIST and vendors including Cisco Systems. To address weaknesses, deployments often combine RADIUS with TLS-encapsulated transports such as RadSec or use proxying and federation patterns seen in large operators like Verizon and research institutions like MIT. Integration with stronger credential systems — for example, certificate-based EAP-TLS backed by Entrust or IdenTrust certificate authorities — mitigates credential theft, while accounting and auditing are often tied into security information and event management platforms from vendors like Splunk and IBM for incident response.

Implementations and Deployments

Multiple open-source and commercial RADIUS implementations exist, including FreeRADIUS, radiator, and solutions from Microsoft (Network Policy Server) and Cisco Systems. Service providers such as Comcast and campus networks at institutions like Stanford University and University of California, Berkeley have historically used RADIUS for subscriber authentication and access control. Telcos integrate RADIUS into billing and AAA ecosystems with mediation systems from vendors like Amdocs and Huawei, while cloud providers such as Amazon Web Services and Google Cloud Platform provide managed services and integrations for authentication proxies and directory synchronization.

Extensions and Related Protocols

RADIUS has spawned and interoperates with several extensions and related protocols. Diameter, developed by the IETF as a successor with peer-to-peer capabilities, was adopted by mobile operators including 3GPP operators for policy and charging control. RadSec (RADIUS over TLS) and RFC updates like those from the EAP working group enhance transport security. RADIUS attribute vendor-specific extensions from Cisco Systems, Juniper Networks, and Huawei enable device- and service-specific integrations, while federation and proxy models are used in large federated identity scenarios involving institutions such as Internet2 and research consortia like GEANT.

Category:Network protocols