In a perfect world
The Authentication Authority Server is not connected at all in order to prevent every unwanted (or not well monitored) outgoing connections (like trojan horses in worst case).
For this you will need
This solution present a strong security approach as they are not connected at all to the internet, but host is harder to maintain up to date: you have to physicaly load each upgrades.
And finally if there exist a way to connect this host to the internet (using the modem or a local gateway) an efficient trojan horse may find them! If this could happen, all this become totally wrong!
Simplier and efficient but lighter
Install your Authentication Authority Server behind a strong firewall that drop every packet but not
- packets from or to the Application server, that match protocol used for.
- packets from the Authentication Authority Server to your SMS provider, that match sms exchange protocol (maybe https) and his replies.
Sample based on GNU/Linux
iptables -t filter -P FORWARD DROP
iptables -t filter -o $LOCIF -i $DMZIF -d $AUTHSERV/32 -s $WEBAPP/32 -p tcp --dport $AUTHPORT -j ACCEPT
iptables -t filter -i $LOCIF -o $DMZIF -s $AUTHSERV/32 -d $WEBAPP/32 -p tcp --sport $AUTHPORT -j ACCEPT
iptables -t filtes -i $LOCIF -o $PUBIF -s $AUTHSERV/32 -d $SMSSERV/32 -p tcp --dport $SMSPORT -j ACCEPT
iptables -t filter -i $PUBIF -o $LOCIF -d $AUTHSERV/32 -s $SMSSERV/32 -p tcp --sport $SMSPORT -m state --state RELATED, ESTABLISHED -j ACCEPT
In this host, a trojan horse could reach Internet directly (must be blocked by firewall), so you have to keep your system and your firewall up to date, with care!
Monitor your traffic
Any case, if you want to trust your Authentication Authority Server, you have to finely and actively monitor all network traffic to this host.
Using low-level network monitor like
tcpdump for sample.