Server for authentication, authorization, and accounting

One or more non-transitory computer readable media storing instructions that are executable by one or more processors to perform acts comprising:

• receiving a registration request to register a service, the registration request signed using a server signature that is based at least in part on a server identifier embedded in a network interface controller of a server hosting the service, the network interface controller including logic to render the server inoperable based at least in part on detecting an attempt to modify the server identifier;
• determining that the server is a trusted device based at least in part on the server signature;
• registering the service;
• receiving, from a client device, a service request requesting permission to access the service, the service request signed using a client signature that is based at least in part on a client identifier embedded in a network interface controller of the client device;
• determining that the client device is excluded from a blacklist that includes banned devices, the blacklist based at least in part on determining a number of denials, by the server, of previous service requests for the service;
• and
• sending the service request to the server hosting the service.

A method, comprising:

• under control of one or more processors configured with specific instructions, the method comprising:
• registering, at a global authentication, authorization, and accounting (AAA) server, at least one service provided by a server fleet comprising one or more servers;
• sending, to a service provider associated with the server fleet, a service request requesting permission for a client device of a client fleet to connect to the at least one service, the service request including a client signature that is based at least in part on a client identifier embedded in a firmware of the client device, wherein the firmware of the client device includes logic to render the client device inoperable based at least in part on detecting an attempt to modify the client identifier;
• and
• determining that the service provider has approved the service request;
• providing client credentials including a client key to the server fleet to enable each server of the server fleet to authenticate communications signed by each client device;
• and
• providing server credentials including a server key to the client fleet to enable each client device of the client fleet to authenticate communications signed by each server.