Method and apparatus for policy-based network access control with arbitrary network access control frameworks

Abstract

A method and apparatus for integrating various network access control frameworks under the control of a single policy decision point (PDP). The apparatus supports pluggable protocol terminators to interface to any number of access protocols or backend support services. The apparatus contains Trust and Identity Mediators to mediate between the protocol terminators and a canonical policy subsystem, translating attributes between framework representations, and a canonical representation using extensible data-driven dictionaries.

What is claimed is: 
     
         1 . A non-transitory computer readable medium comprising instructions which when executed by one or more processors causes performance of:
 receiving a first request;   determining a first set of one or more attributes in a first protocol based on the first request;   translating the first set of attributes from the first protocol to a canonical form;   applying policy rules to the first set of attributes in the canonical form to determine whether to grant the first request;   receiving a second request;   determining a second set of one or more attributes in a second protocol based on the second request, the second protocol being different than the first protocol;   translating the second set of attributes from the second protocol to the canonical form;   applying policy rules to the second set of attributes in the canonical form to determine whether to grant the second request.   
     
     
         2 . The computer readable medium of  claim 1 , further comprising:
 based on the first set of attributes in the canonical form, gathering a first information using a first protocol;   translating the first information into the canonical form;   based on the first set of attributes in the canonical form, gathering a second information using a second protocol;   translating the second information into the canonical form.   
     
     
         3 . The computer readable medium of  claim 1 , wherein the first protocol is a RADIUS protocol and wherein the second protocol is a TACACS+ protocol. 
     
     
         4 . The computer readable medium of  claim 1 , wherein the translating of the first set of attributes and translating of the second set of attributes is performed using a single database comprising a plurality of conversion dictionaries. 
     
     
         5 . The computer readable medium of  claim 1 , wherein the translating the first set of attributes and the second set of attributes is performed by a single translation device. 
     
     
         6 . A non-transitory computer readable medium comprising instructions which when executed by one or more processors causes performance of:
 receiving a first request;   determining one or more attributes based on the first request;   translating the one or more attributes into a canonical form;   based on the one or more attributes in the canonical form, gathering information from at least two different devices;   translating the information into the canonical form.   
     
     
         7 . The computer readable medium of  claim 6 , wherein gathering information comprises gathering a first information from a first device using a first protocol and gathering a second information from a second device using a second protocol. 
     
     
         8 . The computer readable medium of  claim 6 , wherein gathering information comprises a single device gathering a first information from a first device using a first protocol and gathering a second information from a second device using a second protocol. 
     
     
         9 . A non-transitory computer readable medium comprising instructions which when executed by one or more processors causes performance of:
 receiving a first request;   determining one or more attributes based on the first request;   translating the one or more attributes into a canonical form;   based on the one or more attributes in the canonical form, gathering a first information using a first protocol;   translating the first information into the canonical form;   based on the one or more attributes in the canonical form, gathering a second information using a second protocol;   translating the second information into the canonical form.   
     
     
         10 . The computer readable medium of  claim 9 , further comprising:
 applying policy rules to the one or more attributes in the canonical form based on the first information and the second information to determine a policy result.   
     
     
         11 . The computer readable medium of  claim 9 , wherein the translating of the first information and translating of the second information is performed by a single translation device. 
     
     
         12 . The computer readable medium of  claim 9 , wherein the first protocol is an audit protocol and the second protocol is an identity protocol.