基于PKI体系的跨域密钥协商协议

发布时间：2018-07-03 01:36

本文选题：密钥协商 + 共享密钥　；参考：《计算机科学》2017年01期

【摘要】：基于口令的跨域密钥协商协议和Kerberos协议无法抵抗口令猜测攻击,在金融、航天等通信安全需求高的场所,需要一种更有效的协议来保证通信安全。给出一种新的基于PKI体系的跨域密钥协商协议,采用公钥算法保证数据传输的安全,结合使用Diffie-Hellman协议生成会话密钥。协议有效地解决了利用预置共享密钥参与加/解密实施中间人攻击,以及Kerberos弱口令导致的攻击者可以实施口令猜测攻击的问题。跨域通信的公钥信息仅存储在各自域认证服务器,域内用户不需要配置跨域服务器的公钥信息,降低了配置复杂度、域内用户和域认证服务器之间密钥管理的复杂性,同时提高了域服务器鉴别身份的能力和信息机密性,使其免疫多种攻击,具有良好的前向安全性和扩展性。
[Abstract]:The cross domain key negotiation protocol based on password and the Kerberos protocol can not resist the password guessing attack. A more effective protocol is needed to ensure the security of communication in the places where the security needs of Finance and space are high. A new cross domain key negotiation protocol based on PKI system is given, and the security of data transmission is guaranteed by the public key algorithm. The Diffie-Hellman protocol is used to generate session keys. The protocol effectively solves the problem that the attacker can implement a guessing attack by the Kerberos weak password. The public key information of the cross domain communication is only stored in the respective domain authentication server. The user does not need to be in the domain authentication server. To configure the public key information of the cross domain server, the complexity of configuration complexity and the complexity of key management between users and domain authentication servers in the domain are reduced. At the same time, the ability to identify the identity of the domain server and the information confidentiality are improved, so that it is immune to various attacks and has good forward security and extensibility.
【作者单位】：扬州大学信息工程学院;中国科学院信息工程研究所;
【基金】：国家高技术研究发展计划(2013AA011102) 中国科学院战略性先导科技专项课题(Y2W0031102)资助
【分类号】：TN918.4

【参考文献】