分布式联动系统中的多级委托策略研究

Research on Multilevel Delegation Policy in Distributed Response System

目前已有的集中式安全联动防御机制对大规模复杂攻击很难做到协同防范,且容易造成单点服务失效等问题。针对上述不足,在分布式体系结构的基础上提出了一种包含安全联动策略(SRP)和委托管理策略(DAP)的多级委托机制,该机制由联动权限的动态委托和可信委托链的构造方法组成。用XACML Admin规范语言描述了上述两种策略,用形式化的方法描述了委托链的结构组成和委托过程,给出了委托联动算法的伪代码实现。构造可信委托链不仅实现了协同安全联动防御,而且在一定程度上克服了单点失效等问题。提出的安全策略多级委托机制将为构建动态的、分布式的、协作的网络安全防护系统奠定良好的理论基础。

Centralized Security Response System has many shortcomings, such as local response, single service invalidation, lack of cooperative response to large-scale complex attack, etc. In order to enhance the robustness of response system and realize cooperation, based on distributed architecture, this paper introduced multilevel delegation mechanism to response policy：Security Response Policy （SRP） and Delegation Administration Policy （DAP）. This mechanism was composed of dynamic delegation of response privilege and construction of credible delegation chain. SRP and DAP were described by XACML Admin criterion language; the structure of delegation chain and the process of delegation were described in formal method; the delegation response algorithm was presented in pseudocode. Constructing credible delegation chain did not only realize cooperation response, but also solved single point invalidation, etc. Multilevel delegation mechanism will establish favorable theory base for constructing dynamic distributed cooperative network security defense system.