Security Engineering: Access Control and Data Protection

Before any access decision can be made, a system must know who is asking. This begins with identification, the process of presenting a claim to an identity. In the physical world this looks like presenting a driver's license; in an information system, it is the equivalent of typing a username at a login page. The entity making this claim — most often a human user, but potentially a system, service, or application — is called a principal.

Once a principal has identified itself, the relying party must verify that claim through authentication: confirming that the presented identity and credentials are valid, and that the principal truly is who or what it claims to be.

The key insight is that the KDC is only ever presented with full credentials once. Every subsequent access to an individual service is authorized through short-lived, service-specific tickets, minimizing the exposure of the principal's original credentials.