SAML-SSO系统的安全问题分析与改进

发布时间：2018-11-19 21:11

【摘要】：随着网络技术的飞速发展,日常生活和工作中运用到的系统越来越多,与此同时,代表用户身份的数据信息量也迅速飙升。如何整合利用信息资源、简化系统应用以及降低信息维护成本越来越受到人们的重视。要解决这些问题,首先就是要实现用户的统一身份验证,集中高效的管理用户的账号和密码等身份验证信息,而单点登录(SSO,即Single Sign-On的简称)就是实现这一目标的最好方案。单点登录是系统进行身份验证的一个重要组成部分,它可以实现用户在多个应用系统之间,只需要一次身份验证就可以访问互相可信的其他应用系统,得到“一站式服务”的体验。用户在获得便捷的同时,也很关注单点登录系统的安全性。所以对单点登录系统的安全问题进行研究,发现其中的安全漏洞并加以改进和防范,有助于提高单点登录系统的安全性,进而促进单点登录系统的发展和普及,对网络用户体验高效便捷且安全的网络应用服务具有重要的意义。本文重点研究了以下几个方面的内容： (1)研究单点登录系统(也称作“SSO系统”)所涉及到的基本原理、相关技术、现有的多种单点登录实现机制等内容,了解到基于SAML的单点登录系统具备易扩展、跨平台、可移植、方便简单的优势,更符合现在的网络应用环境的要求。 (2)目前的SAML-SSO系统不能抵抗重放攻击、DNS欺骗攻击以及DDoS攻击,通过分析SAML-SSO系统在这些网络攻击手段下出现的安全问题,寻求解决这些安全问题的思路和方法,提出了针对SAML-SSO系统的具体的改进方案,包括采用动静态口令结合的认证方式、SAML断言的用户唯一性检查和SAML断言的唯一性检查以及其他一些辅助性改进方法。 (3)使用Shibboleth开源项目来搭建SAML-SSO系统的实验环境和进行压力测试,验证了改进后的SAML-SSO系统能够有效的解决所发现的安全问题,即SAML-SSO系统的安全性得到了增强。
[Abstract]:With the rapid development of network technology, more and more systems are used in daily life and work. How to integrate and utilize information resources, simplify the application of system and reduce the cost of information maintenance has been paid more and more attention. To solve these problems, the first step is to implement uniform authentication of the user, centralize and efficiently manage the authentication information such as the user's account number and password, while the single sign-on (SSO,) Single Sign-On is the best way to achieve this goal. Single sign-on is an important part of system authentication. It can realize that users can access other application systems that trust each other only once. Get a one-stop service experience. At the same time, users are concerned about the security of single sign-on system. Therefore, to study the security problems of SSO system, to find the security loophole and to improve and prevent it will help to improve the security of SSO system, and then promote the development and popularization of SSO system. It is of great significance for network users to experience efficient, convenient and secure network application services. This paper focuses on the following aspects: (1) the basic principle of single sign-on system (also known as "SSO system"), the related technology, the existing implementation mechanism of single sign-on, and so on. It is understood that the single sign-on system based on SAML has the advantages of easy extension, cross-platform, portability, convenience and simplicity, and meets the requirements of the current network application environment. (2) the current SAML-SSO system cannot resist the replay attack, the DNS spoofing attack and the DDoS attack. By analyzing the security problems in the SAML-SSO system under these network attack methods, we seek the way to solve these security problems. This paper presents a concrete improvement scheme for SAML-SSO system, including the authentication method of combining dynamic and static passwords, the user uniqueness check of SAML assertion, the uniqueness check of SAML assertion, and some other auxiliary improvement methods. (3) the Shibboleth open source project is used to build the experimental environment of SAML-SSO system and carry out the stress test, which verifies that the improved SAML-SSO system can effectively solve the security problems found, that is, the security of the SAML-SSO system has been enhanced.
【学位授予单位】：华中师范大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】