Distributed Multi-Master Cache for AAA Policy Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current AAA systems, such as RADIUS, face challenges in providing high availability and distributed access to network security protocols, limiting their ability to efficiently share and update authentication, authorization, and accounting information across a corporate network, especially in scenarios requiring redundancy and load-balancing.
Innovation Solution
The implementation of a distributed multi-master cache (MMC) that propagates dynamic information across nodes in a cluster, allowing for concurrent access and updates to AAA information, thereby enhancing the high availability and redundancy of policy management systems, and enabling seamless interaction with various network devices without violating standard protocol interfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a distributed multi-master cache is implemented to enable concurrent access and updates to AAA information, then high availability and redundancy are improved, but device complexity increases
Solution Approach 1:
The system segments AAA information storage and management across multiple distributed nodes rather than using a single centralized database. Each node maintains a portion of the AAA information in its local cache, enabling concurrent access and updates without single points of failure. This segmentation directly improves high availability while the distributed architecture manages complexity through modular node design.
Solution Approach 2:
The distributed multi-master cache acts as an intermediary layer between network devices and the central policy management system. This intermediary enables concurrent access and updates by multiple nodes simultaneously while maintaining data consistency through propagation mechanisms, thereby improving availability without requiring direct complex interactions between all system components.
2Loss of information
If dynamic information is propagated across multiple nodes in a cluster, then information consistency and redundancy are improved, but information loss or synchronization delays may occur
Solution Approach 1:
The system performs preliminary actions by pre-populating local caches at each node with AAA information before it is needed for authentication or authorization decisions. This proactive caching reduces the time required to retrieve and synchronize information during actual operations, as nodes already have relevant data locally available rather than waiting for propagation delays.
Solution Approach 2:
The distributed cache system maintains continuous synchronization operations across all nodes, ensuring that information propagation is an ongoing process rather than periodic batches. This continuous action minimizes synchronization gaps and ensures that updates are consistently propagated across the cluster, reducing both information inconsistency and delays in real-time authentication scenarios.
Data Source
AI summary
A distributed policy management (PM) system (e.g., system for authentication, authorization, and accounting (AAA) activities on a network) is provided. Nodes of the PM system may share information of the PM system using a distributed data store (e.g., a multi-master cache). Each node of the distributed PM system may further share information from the distributed data store with other nodes of a corporate infrastructure network by augmenting information in a remote authentication dial-in user service (RADIUS) protocol message. Nodes that are involved in policy management (e.g., network authentication server (NAS) or firewall) without access to the distributed data store may receive information via augmented RADIUS messages. In this manner, devices may be interfaced to the distributed PM system without having access to the distributed data store. High availability and load balancing implementations may be provided by leveraging the distributed data store across nodes of the PM system.