As far as I understand Ethereum uses JSON-RPC to communicate between clients. What is the authentication mechanism? That is, how does the network know that the RPC request is coming from a legit client?
The JSON-RPC interface will talk to anyone who is able to communicate with it over the network. The alternative, IPC, uses a UNIX socket, and will talk to anyone who can access that socket.
If you want to restrict access, you can put it behind a web server that handles authentication and forwards the requests if they are authenticated. See here for an example of how to do this: https://tokenmarket.net/blog/protecting-ethereum-json-rpc-api-with-password/