Secure Access Server Dynamic ACL Management for Network Performance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control methods for mitigating denial-of-service (DoS) attacks are inefficient due to the growth of access control list (ACL) entries, which can impede network performance and are not effectively managed, especially on smaller devices designed to handle large ACLs.
Innovation Solution
Implementing a secure access server (SAS) that maintains a master ACL and communicates with access control nodes (ACNs) to dynamically manage ACL entries, using hold-down timers and null routes to prevent inadmissible packets from entering the network, thereby reducing the load on ACNs and maintaining network performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access control nodes use Access Control Lists to filter network traffic, then security against DoS attacks is improved, but network performance deteriorates due to the growth of ACL entries
Solution Approach 1:
The patent divides the ACL management function into two segments: a secure access server (SAS) that maintains the master ACL and makes security decisions, and access control nodes (ACNs) that enforce decisions but do not store large ACLs. This segmentation allows the SAS to handle ACL growth while ACNs maintain fast packet processing, resolving the contradiction between security and network performance.
Solution Approach 2:
The secure access server acts as an intermediary between the master ACL and the access control nodes. The SAS receives packet characteristics from ACNs, determines admissibility using the master ACL, and returns decisions to ACNs. This intermediary approach allows ACNs to maintain small, efficient decision tables while the SAS handles the comprehensive security policy, resolving the performance-security tradeoff.
2Reliability
If access control nodes maintain large ACLs to block all inadmissible packets, then security is improved, but device complexity increases especially on smaller devices
Solution Approach 1:
The patent extracts the master ACL storage and management function from the access control nodes and places it in the secure access server. ACNs only maintain small decision tables with packet characteristics and corresponding decisions, while the SAS holds the comprehensive master ACL. This extraction eliminates the need for smaller devices to handle large ACLs, reducing device complexity while maintaining security.
Solution Approach 2:
Instead of copying the entire master ACL to each ACN, the system copies only the necessary packet characteristics and decision mappings to ACNs. The ACNs use these compact representations to make fast decisions, while the full master ACL remains centralized at the SAS. This selective copying reduces memory requirements and device complexity at ACNs.
Data Source
AI summary
Receive, at an access control node (ACN) of a first network enclave, a plurality of data packets inbound to the enclave. The characteristics of each received packet can be communicated from the ACN to a secure access server (SAS) of the enclave. The admissibility, to the first enclave, of each received packet for which characteristics are communicated, can be determined by the first secure access server. For each packet determined to be inadmissible, the technology can communicate, from the SAS to a plurality of ACNs of the first enclave, an instruction to deny admission to packets having the characteristics of the inadmissible packet. At each access control node receiving the instruction, the technology can deny admission to packets having the characteristics of the inadmissible packet based on the instruction to deny admission to packets having the characteristics of the inadmissible packet.