Research on Multilevel Delegation Policy in Distributed Response System
Huan Zhang · 2009
Centralized Security Response System has many shortcomings,such as local response,single service invalidation,lack of cooperative response to large-scale complex attack,etc.In order to enhance the robustness of response system and realize cooperation,based on distributed architecture,this paper introduced multilevel delegation mechanism to response policy:Security Response Policy(SRP) and Delegation Administration Policy(DAP).This mechanism was composed of dynamic delegation of response privilege and construction of credible delegation chain.SRP and DAP were described by XACML Admin criterion language;the structure of delegation chain and the process of delegation were described in formal method;the delegation response algorithm was presented in pseudocode.Constructing credible delegation chain did not only realize cooperation response,but also solved single point invalidation,etc.Multilevel delegation mechanism will establish favorable theory base for constructing dynamic distributed cooperative network security defense system.