基于票据的虚拟企业跨异构域认证及密钥协商

发布时间：2019-03-06 12:43

【摘要】：为了满足虚拟企业资源在异构域间的安全有效共享,提出一个基于访问授权票据的跨异构域认证及密钥协商方案。利用基于公钥认证机制的分布式信任模型,在公钥基础设施域的认证中心证书授权与Kerberos域的认证服务器之间建立起第一级信任关系;在此基础上,由认证中心(或认证服务器联合票据授予服务器)生成并分发外域用户U访问本域资源S的授权票据,并通过设计基于对称密钥密码体制的双向跨域认证及密钥协商协议,建立U与S之间的第二级信任关系,协议的安全性通过SVO逻辑得到证明。分析表明,在满足各级安全需求的前提下,所提方法有效降低了终端计算量与通信量,可完全避免Kerberos域终端的公钥加解密运算,在虚拟企业跨异构域身份认证过程中具有良好的可实施性。
[Abstract]:In order to satisfy the secure and efficient sharing of virtual enterprise resources among heterogeneous domains, a cross-domain authentication and key agreement scheme based on access authorization tickets is proposed. By using the distributed trust model based on the public key authentication mechanism, the first-level trust relationship is established between the authentication center certificate authorization in the public key infrastructure domain and the authentication server in the Kerberos domain. On this basis, an authentication authority (or authentication server federated ticket granting server) generates and distributes an authorization ticket for a foreign domain user U to access the local domain resource S. By designing a two-way cross-domain authentication and key agreement protocol based on symmetric key cryptosystem, the second-level trust relationship between U and S is established. The security of the protocol is proved by SVO logic. The analysis shows that under the premise of satisfying the security requirements at all levels, the proposed method can effectively reduce the computation and traffic of the terminal, and can completely avoid the public key encryption and decryption operation of the Kerberos domain terminal. In the virtual enterprise cross-domain identity authentication process has a good implementability.
【作者单位】：西南交通大学信息科学与技术学院;西南交通大学信息安全与国家计算网格四川省重点实验室;
【基金】：国家自然科学基金资助项目(61003245,60903202,61371098) 铁道部重大资助项目(2013X012-A-1,2013X012-A-2,2014X008-A) 四川省杰出青年学术带头人培育计划资助项目(2011JQ0027) 中央高校基本科研业务费资助项目(SWJTU12CX099,SWJTU11CX041)~~
【分类号】：TN918.4

【相似文献】