Network Access Control Using User and Endpoint Attributes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network access control systems struggle to formulate effective security policies due to the dynamic nature of network addresses and the use of personal devices, making it difficult for administrators to know the network address of user devices prior to connection, especially in wireless networks.
Innovation Solution
A network access control system that determines user and endpoint attributes to apply security policies based on higher-level attributes rather than network addresses, using a security enforcer to configure network devices accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security policies are based on network addresses (IP/MAC addresses), then access control can be enforced, but it becomes difficult when network addresses are dynamic or unknown prior to connection
Solution Approach 1:
The patent changes the parameters used for security policy identification from network addresses (IP/MAC) to user identity attributes (username, department, role). This allows security policies to be enforced reliably regardless of dynamic address assignment, while simplifying administrator configuration since user identities are known through authentication processes.
Solution Approach 2:
The patent introduces an intermediary component (NAC system or authentication server) that maps user identities to network addresses. This intermediary enables the system to enforce security policies based on user attributes while still controlling access at the network layer, resolving the contradiction between address-based enforcement and dynamic addressing.
2Ease of operation
If security policies are formulated using lower-level network address rules, then specific access control can be implemented, but the system becomes complex and difficult to manage
Solution Approach 1:
The patent elevates the parameter level from low-level network addresses to high-level user attributes (department, role, username). This parameter change simplifies policy management by allowing administrators to define policies based on organizational structure rather than individual addresses, reducing complexity while maintaining control precision.
Solution Approach 2:
The patent creates universal security policies based on user attributes that can apply to multiple devices and network scenarios. A single policy rule based on user role can control access across numerous devices and time periods, reducing the total number of rules needed and simplifying system management.
3Reliability
If the system maintains access control lists for all possible network addresses, then comprehensive security coverage is achieved, but memory resources are consumed
Solution Approach 1:
The patent changes the basis of access control from enumerating all possible network addresses to using user identity attributes. This parameter change dramatically reduces the state space that needs to be tracked, as user identities are finite and known through authentication, whereas network addresses can be dynamically assigned from large pools.
Solution Approach 2:
The patent uses user identity information (obtained through authentication) as a proxy or copy that represents the user across all their devices and network sessions. This single identity copy enables security policy enforcement without needing to track or store information about each individual device or network address.
Data Source
AI summary
An example network access control system includes a memory storing one or more security policies for an enterprise network; and one or more processors coupled to the memory and configured to: receive a request to connect to the enterprise network from a client device of a user, in response to the receipt of the request, determine one or more user attributes associated with the user and one or more endpoint attributes of the client device, identify a security policy of the one or more security policies based on the one or more user attributes and the one or more endpoint attributes, and configure an access control module of a network device of the enterprise network in accordance with the security policy.