一种结合PKI技术的Kerberos改进协议  

AN IMPROVEMENT KERBEROS PROTOCOL WITH PKI TECHNOLOGY

作　　者：吴喜兰[1] 舒远仲[1] 江泽涛[1] 邬志红[1] 

机构地区：[1]南昌航空大学计算机学院,江西南昌330063

出　　处：《计算机应用与软件》2009年第2期85-86,91,共3页Computer Applications and Software

基　　金：江西省重大攻关招标项目(2005A016);江西省自然科学基金项目(0611092)

摘　　要：分析、研究了Kerberos协议和它的多个改进方案,指出了Kerberos协议的一些局限性,在此基础上提出一种与PKI技术、访问控制相结合的Kerberos改进协议,并采用LDAP存储用户认证信息。与原Kerberos协议对比分析表明,在密钥存储、时钟同步、口令猜测、票据的不可否认性等多项性能方面有一定改进和提高,加强了Kerberos的安全性。In the paper we analysed the Kerberos protocol and some of its improved schemes, and picked out some limitations of it. Based on these, an improved Kerberos protocol combining with PKI technology and access control was put forward, and LDAP was used for storing user＇s authentication information. Comparative analysis of original Kerberos protocol shows, the improved protocol has amelioration and improvement in more than one performances, including key storage, clock synchronization password guess and non - repudiation of the notes, thus the security of Kerberos is enhanced.

关 键 词：KERBEROS 身份认证 PKI RBAC LDAP 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术] TN915.04[自动化与计算机技术—计算机科学与技术]