Search papers, labs, and topics across Lattice.
This paper introduces a RADIUS-based framework for maintaining persistent device identity in Network Access Control (NAC) systems despite MAC address randomization. The framework assigns Globally Unique Identifiers (GUIDs) to endpoints via RADIUS Access-Accept messages, enabling persistent identification across randomized MAC addresses. The proposed architecture supports various use cases, including BYOD, managed devices, VPN, guest access, and IoT, ensuring regulatory compliance and device visibility without client-side modifications.
Enterprises can regain control over network access in the age of MAC address randomization using a RADIUS-based framework that maintains persistent device identity without OS modifications.
Modern operating systems increasingly randomize Media Access Control (MAC) addresses to protect user privacy, fundamentally disrupting Network Access Control (NAC) systems that have relied on MAC addresses as persistent device identifiers for over two decades. This disruption affects critical enterprise environments including federal government agencies operating under FISMA, healthcare organizations subject to HIPAA, financial institutions governed by PCI-DSS, and educational networks managing large-scale BYOD deployments. This paper presents a comprehensive framework for maintaining persistent device identity in NAC environments through a RADIUS protocol-based approach that assigns and distributes a Globally Unique Identifier (GUID) to endpoints via RADIUS Access-Accept messages. The proposed architecture addresses the complete device lifecycle including initial enrollment, re-authentication across randomized addresses, device management integration, certificate-based identity binding, and device attribute correlation. We describe the framework's design across six distinct use cases -- BYOD, managed devices, VPN-based posture assessment, non-VPN posture, guest access, and IoT device profiling -- and analyze its effectiveness in maintaining device visibility, accurate license counting, and regulatory compliance under continuous MAC address randomization. The approach is compatible with existing 802.1X and MAB infrastructure, requires no client-side operating system modifications, and aligns with the recently published RFC 9797 and IEEE 802.11bh-2024 standards. Our framework enables organizations to maintain regulatory compliance while preserving the privacy benefits that MAC address randomization was designed to provide.
