Method for cross-isomerism domain identity authentication and session key negotiation based on access authorization ticket

Abstract

The invention provides a method for cross-isomerism domain identity authentication and session key negotiation based on an access authorization ticket. The method mainly comprises the steps that firstly, a first-level trust relationship is established between a CA of a PKI domain and an AS of a Kerberos domain through a distributed trust model based on a public key authentication mechanism; on the basis, the authorization ticket allowing an outer-domain user to have access to resources of the domain is generated and distributed by the CA or the AS united with a TGS, and through design of a two-way cross-domain authentication and key negotiation protocol based on a symmetric key cryptosystem, a second-level trust relationship allowing the outer-domain user to have access to the resources of the domain is established. On the premise that the requirements for safety of the levels are satisfied, the calculated amount and the communication traffic of a terminal are effectively reduced, public key encryption and decryption operations of a Kerberos domain terminal can be completely avoided, and the implementation is good in the cross-isomerism domain identity authentication process of a dynamic distributed type system, session key negotiation is completed when identity authentication is conducted, and the protocol efficiency is high.

Description

technical field [0001] The invention relates to a cross-heterogeneous domain authentication and key agreement protocol in the field of information security technology, which can be used for cloud computing and cloud storage networks, agile manufacturing, virtual organizations and other distributed systems when users access resources across heterogeneous domains Authentication and session key negotiation. Background technique [0002] In distributed systems such as cloud computing and cloud storage networks, agile manufacturing, and virtual organizations, resources and users are often in different trust domains, and different trust domains may adopt different authentication mechanisms, such as PKI (public authentication) based on asymmetric cryptography. Key infrastructure) authentication mechanism, Kerberos (private key authentication system) authentication mechanism based on symmetric cryptography, and authentication mechanism based on identity or certificateless public key...

AI Technical Summary

Problems solved by technology

However, in this scheme, on the one hand, identity authentication and key negotiation need to be implemented step by step, identity authentication is implemented in steps 1-7, session key negotiation is implemented in steps 8-12, and the communication volume is relatively large; on the other hand, the Each communication entity in the protocol needs to perform multiple public key encryption and decryption operations, and the visitor, the interviewee, the authentication server of the visited domain, and the authentication server of the visited domain need to perform 6, 5, 5, and 8 public key encryption and decryption operations respectively , the amount of calculation and communication is large, the efficiency is low, and it is difficult to implement for Kerberos domain users using symmetric encryption algorithms

Images