초록 ▼

In general, techniques are described for managing multiple access policies in a network access control system. An endpoint device may send, to a policy decision point (“PDP”), a request to communicate on a network. When the PDP receives such an access request, the PDP typically identifies a set of a

In general, techniques are described for managing multiple access policies in a network access control system. An endpoint device may send, to a policy decision point (“PDP”), a request to communicate on a network. When the PDP receives such an access request, the PDP typically identifies a set of access policies to be enforced with regard to the endpoint device and causes the identified access policies to be enforced with regard to the endpoint device. These access policies may specify rights to communicate on networks and/or rights to communicate with server resources and/or endpoint configuration requirements. However, because the endpoint device may issue multiple access requests, conflicting sets of access policies may potentially be enforced with regard to the endpoint device. The techniques described herein ensure that only a consistent set of access policies are enforced with regard to the endpoint device when accessing the network.

대표청구항 ▼

The invention claimed is: 1. A method comprising:receiving a network communication with a network access control policy decision point (“PDP”), wherein the network communication includes a first access request from an endpoint device for access to a network;identifying a first set of access policies

The invention claimed is: 1. A method comprising:receiving a network communication with a network access control policy decision point (“PDP”), wherein the network communication includes a first access request from an endpoint device for access to a network;identifying a first set of access policies based on the first access request;causing access policies in the first set of access policies to be enforced with regard to the endpoint device;while the first set of access policies is being enforced with regard to the endpoint device, receiving another network communication from the endpoint device with the PDP, wherein the other network communication includes a second access request from the endpoint device for access to the same network;determining, in response to receiving the second access request, that the first set of access policies is currently enforced with regard to the endpoint device due to the network communication received by the PDP;identifying, when the first set of access policies is currently enforced with regard to the endpoint device, a second set of access policies based on the second access request; andcausing only access policies in the second set of access policies to be enforced with regard to the endpoint device.