Identity driven networking

Identity driven networking (IDN) is the process of applying network controls to a network device access based on the identity of an individual or a group of individuals responsible to or operating the device.^[1] Individuals are identified, and the network is tuned to respond to their presence by context.

The OSI model provides a method to deliver network traffic, not only to the system but to the application that requested or is listening for data. These applications can operate either as a system based user-daemon process, or as a user application such as a web browser.

Internet security is built around the idea that the ability to request or respond to requests should be subjected to some degree of authentication, validation, authorization, and policy enforcement. Identity driven networking endeavors to resolve user and system based policy into a single management paradigm.

Since the internet comprises a vast range of devices and applications there are also many boundaries and therefore ideas on how to resolve connectivity to users within those boundaries. An endeavor to overlay the system with an identity framework must first decide what an Identity is, determine it, and only then use existing controls to decide what is intended with this new information.

A digital identity represents the connectedness between the real and some projection of an identity; and it may incorporate references to devices as well as resources and policies.

In some systems, policies provide the entitlements that an identity can claim at any particular point in time and space. For example, a person may be entitled to some privileges during work from their workplace that may be denied from home out of hours.

Before a user gets to the network there is usually some form of machine authentication, this probably verifies and configures the system for some basic level of access. Short of mapping a user to a MAC address prior or during this process (802.1x) it is not simple to have users authenticate at this point. It is more usual for a user to attempt to authenticate once the system processes (daemons) are started, and this may well require the network configuration to have already been performed.

It follows that, in principle, the network identity of a device should be established before permitting network connectivity, for example by using digital certificates in place of hardware addresses which are trivial to spoof as device identifiers. Furthermore, a consistent identity model has to account for typical network devices such as routers and switches which can't depend on user identity, since no distinctive user is associated with the device. Absent this capability in practice, however, strong identity is not asserted at the network level.

La primera tarea al intentar aplicar controles de red basados ​​en la identidad consiste en algún tipo de autenticación, ya sea a nivel de dispositivo o en un nivel superior de la pila tecnológica. Dado que el primer componente de infraestructura que se implementa en una red suele ser un sistema operativo de red (NOS), normalmente habrá una Autoridad de Identidad que controle los recursos que contiene el NOS (generalmente impresoras y recursos compartidos de archivos). También habrá procedimientos para autenticar a los usuarios. La incorporación de algún tipo de inicio de sesión único permite que la integración con otros controles sea fluida.

Muchas funcionalidades de la red pueden basarse en tecnologías de autenticación para la implementación de una política de control de acceso.

Por ejemplo, el filtrado de paquetes ( cortafuegos) , el software de control de contenido , los sistemas de gestión de cuotas y los sistemas de calidad de servicio (QoS) son buenos ejemplos de casos en los que los controles pueden depender de la autenticación.

• Protocolos AAA como RADIUS
• LDAP
• Programa de asistencia al empleado (EAP)