【作者】 张启坤；

【导师】 袁占亭； 张秋余；

【作者基本信息】 兰州理工大学 ， 计算机软件与理论， 2008， 硕士

【摘要】 近年来跨域单点登录系统是研究的热点之一,与传统的方案相比,其适用的范围不只局限于一个企业网或校园网,还能扩展到更大范围的网络环境。如果是有多台认证服务器,如何使它们之间可以建立信任关系,使之由一个认证服务器所管理的客户可以访问在另一个认证服务器管理域中的资源,这是目前要解决的问题。最近研究的多域系统的单点登录方案还不能形成较大规模。不能解决不同信任域之间的更强的互操作性问题。只是靠传统的信任关系、约定等基础上建立的信任度。由于这种信任模型是由某个或某些独立的特权机构认证,这种机构没有严格的结构,缺乏约束性,没有组织性。因此在该认证模型的基础上提出的协议缺乏较高的安全性和抗攻击性。针对现有的单点登录机制存在的问题,本文在传统单点登录模型基础之上提出了一种基于格的凌驾于多个单点登录系统之上的分布式联合认证模型,使得多个互为信任的单点登录系统之间可以互为认证,实现更高一个层次上的单点登录与注销。实现真正的一点登录、全网访问,它可以跨地区、跨国界进行访问。该模型具有严密的逻辑结构,有较好的灵活性、可扩展性、可以抵抗单点崩溃、网络瓶颈和减少域间的通信规模。在基于格的多信任域单点登录模型的基础上,提出了相应的跨域认证协议。该协议以格的特有属性来支持不同信任域间的双向实体认证及大规模跨域的联合认证,避免了传统方法中由某个独立的特权机构认证所带来的安全隐患以及重放攻击问题。经推理和证明,该协议具有更高安全性和抗攻击能力。采用蚁群算法动态的跟踪网络资源的变化,以便灵活的更改格的分布式认证模型,同时也解决了传统跨域认证的庞大的通信规模和因缺乏灵活性而不适应现代的网络环境问题。经实验证明,该算法应用到多域间单点登录中能更好利用网络资源,优化多信任域之间的认证,提高了跨域认证的灵活性,有效减少认证的延迟、抖动、节省访问路径的费用。更多还原

【Abstract】 Recently the cross-domain single sign-on is one of hotspot of research. Comparing with the traditional design scheme, it is not only applicable to one enterprise network or campus network, but also can apply to bigger network environment. If there are many authentication servers, how to make trust relationship among servers and let client managed by one authentication server use resources on another authentication server is a problem which will be solved at present. The design scheme of single sign-on can’t form the big scale and it can’t solve the interaction. The credit degree only depends on the trust relation of traditional scheme. Because traditional authentication model privileged by independent prerogative institution, protocol based on traditional authentication model is lack of rigor organizational configuration and restriction. So the protocol that based on this model lack of higher security and resist attack.Aiming at the existing question of single-point logging mechanism, we propose an lattice-based distributed united authentication model over many single-point logging system to make many single-point logging system which construct trust relationship between each other privilege among them, realize higher single-point logging and log-on. It makes one-point logging, whole-network visitation come true, it will be visited over areas and national boundaries, it is rigor organizational configuration, very good agility and expansibility to resist the collapse of single point , bottle-neck of network and reduce the scale of communication.Based on lattice-based single-point logging model with excessive trust field, we put forward cross-domain authentication protocol. The protocol supports mutual entity authentication between different trust fields and united authentication of large-scale cross-domain, avoiding safe hidden trouble, network bottleneck and single-point collapse problems by certain independent prerogative institution authentication in the traditional method. This protocol has higher security and resists attack than traditional protocol by analysis.Moreover, we track transformation of network resources dynamically by ant colony algorithm to modify lattice-based cross-domain authentication model flexibly and solve the problem caused by gigantic communication scales of traditional cross-domain authentication and inelasticity of modern network environment lacking of flexibility. The algorithm makes use of network resources better when it applies to distributed single-point logging, optimizes authentication among many trust fields, improves flexibility of cross-domain authentication, reduces delay and dithering of cross-domain authentication, economize expense of the accessing route.更多还原