Policy Decision Point Reconciling Network Access Conflicts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network access control systems face challenges in enforcing consistent policies across multiple access requests from endpoint devices, leading to potential conflicts and security issues due to the enforcement of conflicting sets of access policies.
Innovation Solution
A method and system where a policy decision point (PDP) determines and enforces a consistent set of access policies for an endpoint device by identifying and reconciling any existing policies, ensuring that only a coherent set of policies is applied, regardless of the device's multiple connections and interfaces.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the policy decision point enforces access policies for each access request independently, then each request can be evaluated based on current policies, but conflicting sets of access policies may be enforced with regard to the same endpoint device
Solution Approach 1:
The policy decision point performs preliminary actions by checking whether access policies are already enforced for an endpoint device before enforcing new policies. This prevents conflicting policy sets from being enforced simultaneously by proactively detecting existing policy enforcement states and reconciling them with incoming policy requirements.
2Adaptability or versatility
If multiple access policies are enforced simultaneously for different connections, then each connection can have appropriate access control, but conflicts arise when the same device connects through multiple interfaces
Solution Approach 1:
The system applies local quality by enforcing access policies locally at each connection interface while maintaining awareness of global policy state. The policy decision point evaluates policies independently for each connection (local quality) but reconciles them against the overall policy enforcement state for the device, allowing multi-connection support without conflicts.
Solution Approach 2:
The policy decision point uses feedback mechanisms to track which access policies are currently enforced for each endpoint device. When a new access request arrives, the system checks the feedback from previous policy enforcement actions and adjusts the new policy enforcement accordingly, ensuring consistency across multiple connections.
3Reliability
If the system tracks and reconciles existing policies for each access request, then policy conflicts are eliminated, but additional processing time and computational resources are required
Solution Approach 1:
The system applies partial action by performing policy reconciliation only when necessary - specifically when an endpoint device with existing enforced policies sends a new access request. The policy decision point selectively checks for existing policy enforcement and reconciles only the relevant policy sets, rather than performing exhaustive checks for all requests, thus reducing unnecessary processing time while maintaining accuracy.
Data Source
AI summary
In general, techniques are described for managing multiple access policies in a network access control system. An endpoint device may send, to a policy decision point (“PDP”), a request to communicate on a network. When the PDP receives such an access request, the PDP typically identifies a set of access policies to be enforced with regard to the endpoint device and causes the identified access policies to be enforced with regard to the endpoint device. These access policies may specify rights to communicate on networks and/or rights to communicate with server resources and/or endpoint configuration requirements. However, because the endpoint device may issue multiple access requests, conflicting sets of access policies may potentially be enforced with regard to the endpoint device. The techniques described herein ensure that only a consistent set of access policies are enforced with regard to the endpoint device when accessing the network.