Design of TNC MAP server based on information fusion

Abstract

In current version of Trusted Network Connection (TNC) architecture, IF-MAP protocol creates a structured way to support real-time data interchange and dynamic management. However, there is a big challenge that the MAP Server has to process mass metadata published by all kinds of other security components in trusted network. In this paper, we propose a novel design for MAP (Metadata Access Point) Sever based on information fusion. A module called HLIF (High level information fusion) is implanted to the current MAP Server. The HLIF module correlates metadata and projects threats in the trusted network to ensure the MAP Clients can share real-time information efficiently and make precise policy decisions in anticipation. Detailed analysis reveals that HLIF module effectively enhances the MAP Server's ability of protecting security components from network attacks in trusted network.