基于国密算法的Kerberos身份认证协议改进与分析  

Improvement and Analysis of Kerberos Identity Authentication Protocol Based on SM Algorithms

作　　者：黄丹丹[1] 张正[1,2] 刘佳欣 HUANG Dan-dan;ZHANG Zheng;LIU Jia-xin(Jinling Institute of Technology,Nanjing 211169,China;Institute of Information Engineering,CAS,Beijing 100093,China;Southeast University,Nanjing 211189,China)

机构地区：[1]金陵科技学院网络安全学院,江苏南京211169 [2]中国科学院信息工程研究所,北京100093 [3]东南大学网络空间安全学院,江苏南京211189

出　　处：《金陵科技学院学报》2022年第2期1-8,共8页Journal of Jinling Institute of Technology

基　　金：江苏省高校自然科学研究面上项目(20KJB110004);未来网络科研基金项目(FNSRFP-2021-YB-30);江苏高校“青蓝工程”资助项目。

摘　　要：针对在分布式网络环境中安全可靠认证用户身份的需求,提出一种基于国密算法的改进的Kerberos身份认证协议。改进的协议通过动态密钥协商技术实现双向安全认证,同时在协议过程中使用了基于国密算法SM2、SM3、SM4的混合密码体制,可抵抗爆破攻击、假冒用户攻击、重放攻击等。通过Python程序模拟认证过程,改进的Kerberos协议安全完成客户端与认证服务器、票据服务器、应用服务器间的相互认证。Since it is important to authenticate users safely and reliably in a distributed network environment,an improved Kerberos identity authentication protocol based on SM algorithm is proposed.The improved protocol realized mutual safety authentication through dynamic key exchange.At the same time,a hybrid cryptosystem based on SM2,SM3 and SM4 is used in the process of the improved protocol,which is resistant to brute force attack,impersonation attack and replay attack,etc.Through the Python program to simulate the authentication process,the improved Kerberos protocol could safely complete the mutual authentication between the client and the authentication server,the ticket server,and the application server.

关 键 词：身份认证 国密算法 KERBEROS协议 分布式网络 混合密码体制 票据 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]