NAS Policy Cache for Resilient Offline Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based network access control (NAC) systems face challenges when the link from network access server (NAS) devices to the cloud-based NAC system is down or experiences significant latency, leading to difficulties in authenticating and authorizing client devices.
Innovation Solution
NAS devices are equipped with a policy cache that stores the last access policy actions identified by the NAC system for client devices, allowing them to authenticate and authorize access even when the link to the NAC system is unavailable.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If cloud-based NAC system is used for centralized access policy management, then access policy maintenance and control is improved, but system reliability deteriorates when link to cloud is down
Solution Approach 1:
The NAS device performs preliminary actions by caching access policy decisions locally before the cloud link fails. The policy cache stores previously obtained access policy actions for client devices, enabling the NAS to make authorization decisions autonomously when cloud connectivity is unavailable, thus maintaining reliability while preserving centralized management benefits.
2Measurement precision
If real-time authentication to cloud NAC system is required, then access control accuracy is improved, but authorization latency increases
Solution Approach 1:
Access policy decisions are obtained from the cloud NAC system in advance and cached locally at the NAS device. When a client device requests access, the NAS retrieves the pre-cached policy decision immediately, eliminating waiting time for cloud response while maintaining accurate access control based on the most recent policies.
Solution Approach 2:
The policy cache acts as an intermediary between the cloud NAC system and the NAS device. It stores access policy actions locally, enabling the NAS to authorize client devices without real-time cloud connectivity, thus reducing authorization latency while maintaining control accuracy through periodic policy updates.
3Loss of information
If continuous connection to cloud NAC system is maintained, then access policy up-to-date is improved, but network bandwidth consumption increases
Solution Approach 1:
The system performs preliminary action by pre-loading and caching access policy decisions at the NAS device before they are needed for client authentication. This eliminates the need for continuous bandwidth consumption to maintain policy currency, as policies are retrieved in bulk beforehand and stored locally for immediate use.
Solution Approach 2:
Instead of continuous connection, the system uses periodic action by updating the policy cache at scheduled intervals or when policy changes are detected. This maintains access policy currency while significantly reducing network bandwidth consumption compared to continuous synchronization.
Data Source
AI summary
A network access server (NAS) device on a wireless network at a site is described, the NAS device comprising memory including a policy cache having entries for one or more client devices where each entry includes a last policy action previously identified by a network access control (NAC) system for the respective client device. The NAS device further comprising processing circuitry configured to, upon receipt of an access request for the wireless network from a client device, authenticate the client device. The processing circuitry is configured to, after authentication of the client device, determine whether the client device is included in the policy cache. The processing circuitry is configured to, based on the client device being included in the policy cache, authorize the client device to access the wireless network in accordance with the last policy action for the client device.