Network authentication and key allocation method across secure domains

Abstract

The invention discloses a method for network authentication and key distribution across security domains. Single sign-on based on tokens is used to form each security domain with a verification server and several application servers. According to the needs of application servers in the domain, authentication and key distribution are performed. The process is as follows: firstly, the user performs identity authentication in this security domain, and obtains a service token for communicating with an application server in another security domain; Verify the service token in the entered security domain to obtain the service connected to the application server; finally, the user authenticates the application server. The system realizing the method includes a client access subsystem, an application service subsystem and an authentication server, and the authentication server completes two functions of user identity authentication and service authorization. The invention simplifies the network authentication process, has security and high efficiency, and is suitable for authentication and key distribution across security domains in a distributed network environment.

Description

technical field [0001] The invention belongs to the technical field of communication network security, in particular to a token-based single sign-on method applicable to various distributed network environments across security domains, which provides users with access to distributed networks that only need to perform One-time identity authentication can realize the authentication and key distribution services across security domains for accessing multiple systems, ensuring the security and effectiveness of distributed collaborative work. Background technique [0002] With the popularization and application of distributed networks, network access security issues are getting more and more attention. Authentication is a key technology of network access security, and it plays an extremely important role in preventing malicious attacks and protecting the rights and interests of legitimate users. Authentication includes two meanings: one is identity authentication, that is, to co...

AI Technical Summary

Problems solved by technology

Its limitations are: (1) the complexity is too high, and it is not easy to realize; (2) the way of entering passwords is used to connect online. Although the passwords are hashed to improve security, the threat of password guessing attacks has not been eradicated, especially When the password selected by the user is not strong enough, the password guessing attack is more likely to be successful; (3) The use of time stamp in the SPX model is similar to the Kerberos system, and the system clock must be kept synchronized, so the ability to prevent replay attacks is poor

Because a large number of user names and passwords are not easy for users to remember, users often use simple information as passwords or set the same password, which brings huge hidden dangers to security. For this reason, managers need to create multiple user databases. Naturally cause inconvenience and cumbersome management

Images