The Wild West of Early Internet
Picture the internet in the early 1990s. It was a cacophony of screeching modems and busy signals. For the burgeoning Internet Service Providers (ISPs), business was booming, but it was also a logistical nightmare. Each time a customer dialed in to get
online, the ISP's equipment—the Network Access Server (NAS)—had to check if they were a paying subscriber. The simple way to do this was to store a list of usernames and passwords on every single access server. For a small operation, this was manageable. But as ISPs grew from managing dozens of modems to hundreds or thousands, this model became a disaster. Updating a user's password meant logging into every server individually. Billing was a mess, and security was a constant worry. A single point of management was desperately needed.
Livingston's Elegant Solution
Enter Livingston Enterprises, a networking company that built the popular PortMaster access servers used by many ISPs. Facing this scaling problem, they developed a protocol in 1991 called Remote Authentication Dial-In User Service, or RADIUS. The idea was brilliantly simple: decouple the 'bouncer' from the 'guest list'. The access server (the bouncer) would no longer keep its own list. Instead, when a user tried to connect, the NAS would send a query to a single, centralized RADIUS server (the keeper of the guest list). This central server would check the user's credentials and send back a simple 'Access-Accept' or 'Access-Reject' message. Suddenly, managing thousands of users became simple. You only had to update one master database.
Designed for a Dial-Up World
The true genius of RADIUS, and the reason it has survived for decades, lies in how it was tailored to the technological limits of its time. Its core design choices were direct responses to the slow, unreliable, and low-bandwidth nature of dial-up connections. For one, it was designed to be incredibly lightweight. It also famously runs on UDP, a 'fire-and-forget' transport protocol, instead of the more robust TCP. This seems odd for something as important as authentication, but it was a deliberate choice. In an environment with flaky dial-up connections, the overhead of establishing and maintaining a formal TCP connection was too slow and resource-intensive. UDP was faster and simpler, and the protocol itself handled the logic of retransmitting requests if a server didn't respond.
The Power of Three: AAA
Beyond its lean design, RADIUS introduced a clear separation of three crucial functions: Authentication, Authorization, and Accounting (AAA). Authentication asks, 'Who are you?'. Authorization asks, 'What are you allowed to do?'. And Accounting asks, 'What did you do?'. This split was revolutionary. It meant an ISP could use the same system to not only verify a user's identity but also assign them specific permissions (like a certain speed) and, critically, track their usage for billing. The accounting messages, sent at the start and end of a session, recorded how long a user was connected, which was the lifeblood of the per-hour billing models common at the time. This modular AAA framework provided the flexibility and control that ISPs needed to grow their businesses.
