一种基于Kerberos扩展的Web服务安全框架

发布时间：2018-05-14 03:25

本文选题：Web服务 + Web服务安全　；参考：《武汉大学学报(理学版)》2017年02期

【摘要】：Web服务安全问题集中表现在信任建立、端到端消息安全保障以及资源访问控制等方面.传统的Web安全框架如Atlassian Seraph和Apache Shiro无法同时解决消息安全保护和跨域访问控制的问题.本文提出并实现一种基于Kerberos的Web服务安全框架——KBW2SF,它包括用户认证、消息安全通信、服务访问控制三个核心功能.用户认证使用Kerberos作为底层协议在服务请求发和提供方之间建立信任关系;安全通信使用WSSecurity规范及Kerberos票据中的密钥保证消息端到端的完整性和机密性;服务访问控制基于Kerberos票据中的用户角色信息,由服务提供方对来访用户进行角色映射(跨域访问)和权限鉴定,以此保护服务资源不被非法或者低权限用户访问.同时,KBW2SF引入缓存管理机制提高应用效率,降低安全机制对Web服务应用的影响程度.通过应用场景的实验分析,该框架不但能够有效解决Web服务消息的安全性以及跨域访问控制问题,而且具有较高的效率,具备一定的实际应用价值.
[Abstract]:The security problems of Web services focus on trust building, end-to-end message security and resource access control. Traditional Web security framework such as Atlassian Seraph and Apache Shiro can not solve the problem of message security and cross-domain access control simultaneously. This paper proposes and implements a Web service security framework based on Kerberos, which includes three core functions: user authentication, message security communication and service access control. User authentication uses Kerberos as the underlying protocol to establish a trust relationship between the service request sender and the provider, and the secure communication uses the WSSecurity specification and the key in the Kerberos ticket to ensure the end-to-end integrity and confidentiality of the message. Service access control is based on the user role information in the Kerberos ticket, and the service provider performs role mapping (cross-domain access) and authorization authentication to the visiting user, so as to protect the service resource from illegal or low-privilege user access. At the same time, KBW2SF introduces cache management mechanism to improve application efficiency and reduce the impact of security mechanism on Web services applications. Through the experimental analysis of the application scenario, the framework not only can effectively solve the security of Web service messages and cross-domain access control problems, but also has high efficiency and practical application value.
【作者单位】：武汉大学空天信息安全与可信计算教育部重点实验室;武汉大学软件工程国家重点实验室;武汉大学计算机学院;武汉理工大学计算机科学与技术学院;中兴通信有限公司;湖北省电力公司;
【基金】：国家自然科学基金资助项目(61303024) 江苏省自然科学基金资助项目(BK20130372)
【分类号】：TP393.08

【相似文献】