As cloud computing techniques become more widespread and firms’ digital transformation deepens, more and more enterprises migrate their business systems and IT infrastructure to the clouds, and corporate networks are also traditional"With the data centre at its core"The structure of the"Local + Cloud"In a mixed cloud environment, staff may access the network at any location in their offices, homes, cafés, client sites, and resources may be accessed locally at data centres or in public or private clouds. Traditional web-based access controls no longer accommodate the requirements of the mixed cloud environment, and network access certification systems need to evolve towards cloud deployment and hybrid cloud access.
Why do network access require clouded deployment?
Traditional network access certification systems are usually deployed locally: access controllers, RADIS servers, strategy management centres, etc. are deployed in enterprise local data centres and are connected to equipment such as switchboards, wireless controllers, etc. via local networks."With the data centre at its core"The network is feasible but faces many challenges in a mixed cloud environment: first, the high deployment and maintenance costs of the enterprise will require local procurement of servers, implementation of operating systems, deployment and configuration of access systems, as well as dedicated maintenance, and for enterprises with large branches, access equipment will need to be deployed at each branch, which is more costly; and second, the capacity of locally deployed access systems will be poor in terms of expansion, limited to the hardware configuration of local servers, and when end-volume growth or combined volume increases, extended hardware will be required, with long life cycles and high cost; Third, remote access difficulties, where staff need to be connected to the enterprise network in a location outside their office (e.g. home, on mission), traditional local access systems cannot directly control the long-distance access terminals and usually require VPN access, which is poor and unsafe; fourth, cloud access controls are lacking, and when an enterprise ' s business system moves to the cloud end, staff access to cloud resources is not through local access systems, and traditional access controls do not allow for identification and compliance checks of terminals accessing cloud resources; Fifthly, there are multiple branch management difficulties, with locally deployed access systems usually being decentralized for multi-branch enterprises, and branches having inconsistent access strategies, inconsistent security conditions, and difficult to achieve uniform security controls. The clouded network access certification system can address these challenges: first, deployment and maintenance costs will be reduced, the clouded deployment system will be operated by a cloud service provider, which will need to deploy and manage users without concern for bottom hardware and system maintenance; second, it will be flexible expansion, whereby cloud deployments will be able to expand automatically and without manual enterprise magnification depending on the number of terminals and volume of hairs; Third, remote access is supported and cloud-based deployment access systems can directly control the remote access terminals through the Internet, with employees being subject to uniform access controls at any location; fourth, cloud-based access systems are supported, which can be integrated with cloud platforms (e.g. Ali Clouds, Tantsing Clouds, AWS, Azure, etc.) for identification and compliance checks of terminals that access cloud resources; fifth, multi-branch management, where cloud-based deployment access systems provide a unified management control platform, and enterprises can manage access strategies and terminal status of all branches on one platform and achieve uniform security control. For enterprises, cloudization deployment is a necessary trend in network access to adapt to the mixed cloud age.
Structured model for cloudized deployment
The cloudization of network access certification systems is based on three main architecture models: the SaaS model, where all components of the access system (strategic management centre, authentication service, terminal management, Log Audit etc.) are deployed at cloud ends, enterprises have Internet access to cloudy end access services, and local deployment of light-weight access agents (e.g. RADIFUS agent, Portal agent) is required to transmit requests for certification of local network equipment to cloud ends. The pure SaaS model has the advantage of deploying the simplest, least costly maintenance and most resilient extension capabilities; The disadvantage is the high reliance on Internet connectivity, local access certification will not be normal (which can be downgraded through a local cache strategy) if the enterprise has interrupted its Internet connection to the cloud and there may be compliance risks for enterprises with high data security requirements. Second, there is a mixed deployment model, the strategic management centre and management control platform of the access system are deployed at the cloud end, authentication services and enforcement nodes are deployed locally (local data centres or branches), and the policies and data are synchronized via encrypted channels between the cloud and the local location. The advantage of the hybrid deployment model is to balance the ease of cloud management with the reliability of local deployments, that local certification services do not rely on Internet connectivity and that local access certification can function properly even if cloud-side connections are interrupted; the disadvantage is that the structure is relatively complex and requires maintaining local authentication service nodes. Third, private cloud models, where access systems are deployed in the company ' s own private cloud (e.g. VMware, OpenStack, Hyper-V etc.), with full control and data sovereignty over the enterprise, which can provide a flexible extension similar to public cloud, but infrastructure is maintained by the enterprise itself. Private cloud models are suitable for enterprises that have high data security and compliance requirements and do not want to store data in public clouds (e.g. finance, government, military industry, etc.). Each of the three structural models has advantages and merits, and businesses should choose the appropriate deployment model based on their own safety requirements, compliance needs, IT infrastructure, and budgetary circumstances. For most SMEs, the purely SaaS model is the best price-for-money option; for large firms and multi-branch enterprises, mixed deployment models are options that balance reliability with managerial convenience; and for enterprises with very high data security requirements, the private cloud model is a safer option. In actual deployment, multiple models (e.g. private cloud at headquarters and SaaS for branches) can also be used in response to different regional and operational requirements.
Identifier and terminal control for mixed cloud access
In a mixed cloud environment, where employees may access local and cloud resources from any location or terminal to the enterprise, network access systems require uniform identity and end control of all access scenarios. The control of mixed cloud access includes mainly the following: one is integrated identity management, a mixed cloud environment requires staff to access resources in local systems and multiple cloud platforms, and if each system has an independent account code, staff need to remember multiple sets of accounts, manage confusion and have high safety risks. Cloud-deployed access systems support integration with enterprise ' s unified identification platform (such as AD domain, LDAP, Okta, Azure AD, etc.) to achieve single point login (SSO), where staff can access all authorized resources using an account number and identity information is managed centrally in all systems. Second, end compliance checks, whether staff are connected from office or remote, whether local or cloud resources are accessed, require a system of access that requires a compliance check of the terminal (whether patched, poisoned, non-compliant software, encryption, etc.), and only one compliance terminal can access the resource. For remote access terminals, cloud-access systems can be checked for compliance by means of terminal or non-agent scanning at the cloud end. Third, dynamic access controls, when mixed cloud environments, should not be static and should be adjusted to the dynamics of staff members ' identities, terminal status, access location, access time, access resources etc. For example, employees use compliance terminals in their offices and have access to all authorized resources; staff use personal devices in cafés with limited resources only; staff access sensitive systems during irregular periods requires additional identification. Dynamic access control is the core concept of a zero-trust architecture, and cloud-based deployment access systems can support dynamic access controls based on context. Fourthly, cloud-resource access controls allow cloud access systems to be integrated with IAM when staff visit resources on cloud platforms, and endpoints accessing cloud resources are verified and checked to ensure that only authorized and compliant terminals can access cloud resources. Fifthly, there is a continuous trust assessment that access systems should not be certified and checked only during access in mixed cloud environments, but rather should continuously assess the end-of-pipe confidence status throughout the visit process, dynamically adjusting or withdrawing access when the terminal ' s security state changes (e.g. infected virus, abnormal behaviour). The continuous trust assessment is an important feature of zero-trust structures, and cloud-based deployment access systems can support ongoing end-state monitoring and confidence assessments.
Security and compliance with cloudized deployments
The clouded deployment of network access systems involves enterprise network access data and terminal security data, which are sensitive to the enterprise and cloudization deployments must ensure their safety and compliance. The main aspects of cloudized deployment security and compliance include: first, secure data transmission, and the use of encrypted channels (e.g. TLS, IPsec VPN, special wire) for local and cloud-end data transfer, preventing data from being tapped or tampered with during transmission; Second, data storage security; access and terminal data stored on cloud ends should be encrypted and the encryption key should be managed by the enterprise itself (BYOK, Bring Young Key Key), even if cloud service providers cannot decipher the company ' s data; third, data sovereignty and geographical limitations, for enterprises with data sovereignty requirements (e.g. finance, government, military industry etc.), data storage should be selected as a cloud service provider in designated areas to ensure that data are not exported or removed from specified areas; fourth, access control, management controllers of cloud access systems should apply strict access controls, including multifactor certification, role-competence management, operational auditing, etc., to prevent unauthorized access and operation; Fifthly, the compliance certification, and the cloud service provider of the cloud access system should ensure that the level of security management of cloud services is in line with requirements through relevant safety compliance certifications (e.g. ISO 27001, SOC 2, etc., credible clouds, etc.); sixthly, data backup and recovery, cloud-end access data should be backed up regularly and backup data should be stored encrypted in different geographical locations to ensure rapid recovery in case of disaster; Seventh, privacy protection. The end-of-life information and user behaviour data collected by cloud access systems involve the privacy of users and should be collected and used in a legally compliant manner, informing users of the scope and use of information gathered, and protecting their privacy through measures such as data desensitization and anonymity; eighth, security incident response, cloud service providers should establish well-developed safety incident response mechanisms that can be detected, responded to and disposed of in a timely manner when a security incident occurs and notify business customers. For enterprises, cloud access systems should be selected with careful assessment of the security capabilities and compliance levels of cloud service providers, with detailed service level agreements (SLAs) and data-processing agreements (DPAs), which clarify the security responsibilities and obligations of both parties and ensure safety and compliance in cloud deployment.
Implementation recommendations for cloudized deployment
In implementing the network access certification system for cloudized deployments, enterprises recommend that it be advanced in the following steps: first, by assessing needs and current conditions, by undertaking a comprehensive assessment of the enterprise ' s network environment, end types, business systems distribution (local/bundling), security requirements, compliance requirements, budget situation, etc., and by identifying the objectives and requirements for clouded deployment; second, by selecting deployment models, choosing the appropriate cloud-based deployment model based on evaluation results (pure SaaS, mixed deployment, private cloud) and, for large and multi-branch enterprises, recommending that priority be given to hybrid deployment modalities; The third step is to select cloud service providers and products, choosing those with high safety capabilities, high compliance levels, well-functioning products, well-serviced cloud service providers and access products, focusing on the ability of product identity management, end compliance, dynamic access control, cloud platform integration, security compliance; and the fourth step is to develop a migration plan and detailed relocation plans for local deployments to cloudized deployments, including strategic migration, user migration, terminal migration, equipment configuration changes, etc., and to identify time nodes, duty bearers, rollback options for migration; The fifth step, pilot deployment, is to be implemented on a small scale (e.g., in a department or branch), to validate the functionality, performance, stability and user experience of cloud access systems, collect feedback and optimize; the sixth step, full roll-out, with successful piloting, gradually spread throughout the enterprise as part of the roll-out plan, with user training and technical support during the roll-out process; the seventh step, continuous optimization, with the completion of cloudization deployment, establishes an ongoing operational and optimal mechanism for regularly assessing the effectiveness of access strategies, analysing security logs and alerts, optimizing strategy configuration, updating end compliance baselines and conducting safety training. In the implementation process, particular attention should be paid to the following: first, not to switch across a single-time scale and gradually migrate through greyscale distribution to avoid shifting operations; second, to develop local downscaling programmes that would allow for the deployment of cache strategies and downscaling mechanisms locally even if the SaaS model were adopted, ensuring that local access certification can still function properly in case Internet connectivity is interrupted; third, to integrate existing systems, which should be integrated with existing enterprise systems such as AD domain, uniform identification, terminal management, SOC, cloud platform IAM and avoid creating new information silos; Fourth, attention should be paid to user experiences. The access systems for cloud deployment should provide good user experience, especially with remote access and access to cloud resources, so as not to affect the efficiency of staff because security measures are too complex; fifthly, cloud cost management mechanisms should be established, while cloud deployments may reduce hardware costs, but subscription and flow costs for cloud services may increase with usage, and cloud cost management mechanisms should be put in place to regularly assess and optimize cloud resource use and control cloud costs.
The cloudy deployment of network access certification systems and mixed cloud access are inevitable trends for companies to adapt to the cloud-mixing era and zero trust structures. Through a flexible architecture model, such as pure SaaS, hybrid deployments, private clouds, cloud-based deployments can reduce deployment and maintenance costs, increase resilience expansion capabilities, support remote access and cloud resource access control, and achieve integrated multi-branch management. At the same time, cloud deployment must ensure data security and compliance, including encryption of data transmission, storage encryption, data sovereignty, access control, conformity certification, privacy protection, etc. For businesses, selecting suitable cloud deployment models and a secure cloud service provider, developing detailed migration plans and steadily advancing, is key to successful implementation of cloud network access. In a context of growing cloud computing and zero trust, cloud-based deployed network access certification systems will become an enterprise’s safety infrastructure for intranet safety, providing firm safeguards for the digital transformation of enterprises and hybrid cloud operations.