🤖 AI Summary
This work addresses the challenge posed by MAC address randomization, which undermines the ability of traditional Network Access Control (NAC) systems to uniquely identify devices, thereby compromising enterprise compliance and management. To resolve this, the authors propose a compatibility framework leveraging the RADIUS protocol that assigns a globally unique identifier (GUID) within the Access-Accept message without requiring modifications to client operating systems. This GUID is cryptographically bound to the device certificate, enabling persistent, cross-session identity tracking. The solution seamlessly integrates with existing 802.1X and MAC Authentication Bypass (MAB) infrastructures and aligns with RFC 9797 and IEEE 802.11bh-2024 standards. It effectively restores device visibility, ensures accurate license accounting, and maintains regulatory compliance—all while preserving the privacy benefits afforded by MAC address randomization.
📝 Abstract
Modern operating systems increasingly randomize Media Access Control (MAC) addresses to protect user privacy, fundamentally disrupting Network Access Control (NAC) systems that have relied on MAC addresses as persistent device identifiers for over two decades. This disruption affects critical enterprise environments including federal government agencies operating under FISMA, healthcare organizations subject to HIPAA, financial institutions governed by PCI-DSS, and educational networks managing large-scale BYOD deployments. This paper presents a comprehensive framework for maintaining persistent device identity in NAC environments through a RADIUS protocol-based approach that assigns and distributes a Globally Unique Identifier (GUID) to endpoints via RADIUS Access-Accept messages. The proposed architecture addresses the complete device lifecycle including initial enrollment, re-authentication across randomized addresses, device management integration, certificate-based identity binding, and device attribute correlation. We describe the framework's design across six distinct use cases -- BYOD, managed devices, VPN-based posture assessment, non-VPN posture, guest access, and IoT device profiling -- and analyze its effectiveness in maintaining device visibility, accurate license counting, and regulatory compliance under continuous MAC address randomization. The approach is compatible with existing 802.1X and MAB infrastructure, requires no client-side operating system modifications, and aligns with the recently published RFC 9797 and IEEE 802.11bh-2024 standards. Our framework enables organizations to maintain regulatory compliance while preserving the privacy benefits that MAC address randomization was designed to provide.