基于PKI/PMI的校园网安全单一登录方案

传统C/S应用大多采用基于私有口令系统的认证和授权,这增加了系统管理负担,也增加了用户的记忆和输入负担。单一登录是提高用户工作效率和降低管理成本的解决办法,但现有的单一登录方案多数需要重新设计C/S程序或者未采用强认证和授权的机制。该文提出一种“代理-经纪人-网关”单一登录模型,并基于PKI和PMI技术设计了一种针对校园网C/S应用的集中认证和授权的单一登录方案(TH-SSO),可有效地避免修改现有C/S应用程序,同时为应用提供了强健的认证和授权。

A Single Sign-on Solution for Campus Networks Based on PKI and PMI

Traditional client/server applications have a proprietary password-based authentication system,which imposes a burden of memorizing and re-typing lots of passwords upon users,as well as increases management cost.Single Sign-On(SSO) is a way to enhance user productivity and ease management.Most existing SSO technologies either require to redesign the C/S applications or still adopt weak authentication and authorization mechanism.This paper proposes anAgent-Broker-Gateway SSO scheme(TH-SSO).The TH-SSO scheme makes use of Public Key Infrastructure(PKI) and Privilege Management Infrastructure(PMI) to provide strong authentication and flexible authorization,and need not modify legacy C/S applications.