The thesis focuses on designing and implementing a proof-of-concept solution of a new access architecture in the eduVPN system, which will eliminate the need to manage multiple profiles and enable finer access control directly on the side of the eduVPN server. 

The student will first familiarize themselves with the current deployment of eduVPN at Masaryk University, the means of user profile management, and their relation to identity management systems. Based on this information, they will design a proof-of-concept software implementing an architecture that uses a unified eduVPN profile for all users and controls access to specific services through local firewall rules on eduVPN nodes. 

As part of the work, an interface for storing mappings of users to network services they are authorized to access will be designed and implemented. This interface will be designed so it can integrate with identity management systems which contain the necessary information about permissions. On the eduVPN server side, a process will be implemented that dynamically generates appropriate local firewall rules when a user connects, allowing them access only to permitted network services. 

In the final part, the student will test the functionality of the solution, measure the impact of a large number of generated firewall rules on the performance and throughput of eduVPN nodes, and, based on the results obtained, evaluate whether this approach is suitable for further use within Masaryk University. 

The created code will be publicly available in the IS under the BSD License 2.0.