NPSS Federated Identity Providers and Distributed Policy Enforcement Points: Revocation Consistency

Question

Consistency in Distributed Policy Enforcement
The National Public Safety Systems (NPSS) architecture implements Attribute-Based Access Control (ABAC) to manage data access across federated identity providers. This model utilizes a Policy Decision Point (PDP) to evaluate real-time attributes, which are then enforced by distributed Policy Enforcement Points (PEP) at the network edge.
To maintain performance, these PEPs often utilize local policy caches. However, a technical uncertainty exists regarding the consistency-availability trade-off when network partitions occur between the central identity store and high-latency edge nodes.
When a responder's credentials are revoked or clearance attributes are modified, the propagation delay to the edge can create a window of unauthorized access. It is unclear how the framework handles the immediate invalidation of these cached attributes during a partition.

What is the documented behavior for credential revocation at the PEP when the node is disconnected from the primary PDP?
  Does the NPSS framework provide a mechanism for forced cache invalidation across federated boundaries that does not rely on a persistent connection?

Tasadduq Burney · Answer

Consistency in Distributed Policy Enforcement
In NPSS-federated ABAC architecture, the trade-off between performance and security is governed by the local caching strategy of the Policy Enforcement Point (PEP). When a network partition occurs, the PEP loses its ability to query the Policy Decision Point (PDP) or central identity store for real-time attribute validation.

Documented Behavior During Partitions
When a node is disconnected from the primary PDP, it typically follows one of two behaviors based on the fail-open/fail-closed configuration of the specific edge node:

Availability-First (Open): The PEP continues to grant access using cached attributes until their Time-to-Live (TTL) expires. This ensures responders maintain access to data during outages but creates a window of unauthorized access for revoked credentials.
  Consistency-First (Closed): The PEP denies all requests that cannot be verified against current revocation status once the local cache is stale. This prevents unauthorized access but can result in critical operational failures for field responders.

Forced Cache Invalidation
The NPSS framework generally does not provide a mechanism for forced cache invalidation that functions without a persistent connection. Because invalidation signals typically rely on a 'push' model (e.g., webhooks or distributed pub/sub notifications), a total network partition prevents the invalidation signal from reaching the isolated edge node.

Recommended Steps for Consistency Management
To mitigate the risk of unauthorized access during partitions, implement the following strategies:

Shorten TTLs: Reduce the duration that clearance attributes are cached locally to minimize the window of vulnerability during a partition.
  Local Revocation Lists: Configure the PEP to pull a local, compressed revocation list (CRL) that is updated whenever connectivity is available, independent of full attribute synchronization.
  Attribute-Based Degradation: Use ABAC policies that restrict high-sensitivity data if the 'last synchronized' timestamp exceeds a specific threshold.

To provide a more specific recommendation, are your current PEP nodes configured to fail-open or fail-closed when the PDP is unreachable?

NPSS Federated Identity Providers and Distributed Policy Enforcement Points: Revocation Consistency

Consistency in Distributed Policy Enforcement

1 answer

Consistency in Distributed Policy Enforcement

Documented Behavior During Partitions

Forced Cache Invalidation

Recommended Steps for Consistency Management

Your perspective belongs here.

0 question comments