A Computer Network Defense-Oriented Scheme Description Language

Existing defense policy description language can describe some aspects of defense only, such as protection or detection but cannot express relationship among actions. Thus, it cannot accomplish a joint defense goal with the linkage of all kinds of defense mechanism for large-scale, distributed network attacking, such as Botnet. To solve this problem, we proposed a computer network defense-oriented scheme description language (CNDSDL), which can describe protection, detection, analysis, response, and recover actions as well as relationship among actions. These relations include sequence-and, sequence-or, concurrent-and, concurrent-or, and xor. It provides a unified coupling language description for linkage defense of different security devices. At last, we realized the simulation of schemes which are described by CNDSDL. The experiments results show that CNDSDL can be transformed to detailed technique rules and realize the defense effect of expression.

Research on Policy-Based Service-Oriented Computing Security

This article described the Web Services security protocols, and the policy description language XACML was analyzed in detail in the Web Services. XACML is characterized by the strong ability of expansion and the favorable inter-operation in the access control of the Web Services, which are concluded from the comparison in both SOA strategic architectures. A collection of XACML policy combination algorithms and decision algorithms were discussed in the policy-based service-oriented computing, then the policy control and access control mechanism were also illustrated, and the corresponding decision model was described, at last the development of XACML was prospected.