Multi-Tenant Cloud NAC Clusters for Scalable Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud-based network access control (NAC) systems face challenges with multi-tenancy and scalability, as authentication servers like RADIUS or FreeRADIUS support multi-tenancy using virtual servers but do not support clustering, making it expensive and complex to assign a single authentication instance to each organization.
Innovation Solution
A cloud-based network management system (NMS) manages multiple groups of authentication server instances, each group serving a set of tenants with identical configuration files, and uses load balancing to distribute authentication requests across these instances, enhancing scalability and availability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a single authentication instance is assigned to each organization, then multi-tenancy is supported, but system complexity and cost increase significantly
Solution Approach 1:
The authentication server is segmented into multiple independent instances grouped into clusters. Each cluster serves a specific set of tenants, dividing the system into manageable units that can be independently managed and scaled, reducing overall system complexity while maintaining multi-tenancy support
Solution Approach 2:
Authentication server instances are designed to be universal and can serve multiple tenants within their assigned cluster. The instances use identical configuration files and can authenticate requests from any NAS device associated with their tenant group, eliminating the need for dedicated instances per organization
2Productivity
If multiple authentication server instances are deployed, then scalability is improved, but managing tenant-instance assignments becomes complex
Solution Approach 1:
The system segments authentication servers into clusters, where each cluster is assigned to a specific set of tenants. This segmentation allows scalable deployment while simplifying management by creating clear boundaries between tenant groups and their corresponding authentication instances
Solution Approach 2:
The system introduces an intermediary mechanism (the cluster assignment model) that automatically manages tenant-instance mappings. The NAC system determines which cluster serves which tenant based on predefined assignments, eliminating the need for manual configuration and reducing management complexity
3Reliability
If authentication requests are distributed across multiple instances, then availability is improved, but load balancing complexity increases
Solution Approach 1:
The system segments authentication requests by routing them to specific clusters based on tenant identification. This segmentation approach provides load distribution and high availability while avoiding complex load balancing algorithms by using simple tenant-to-cluster mapping rules
Solution Approach 2:
The system changes the routing parameter from complex load balancing metrics to simple tenant identification. By using the tenant indicator in authentication requests to determine cluster assignment, the system achieves load distribution and availability without requiring sophisticated load balancing complexity
Data Source
AI summary
A cloud-based architecture includes a cloud-based network management system (NMS) that provides the management plane and one or more cloud-based NAC systems that provide NAC services, including end-point device authentication. The cloud-based NAC system may have multiple groups of authentication server instances. Each group may have multiple authentication server instances to allow the authentication service provided by the group to serve more client devices than a single authentication server instance alone. Different Groups can be configured differently to serve different tenant sets.