基于SAML与XKMS的安全单点登录认证模型的研究与实现*

针对Browser/Artifact方式进行单点登录时存在的安全性问题，设计出一种基于SAML与XKMS的安全单点登录认证模型。它采用一种结合传统PKI与XML密钥管理规范（XKMS）的统一密钥管理子层来提供密钥管理，使用XML数字签名和加密技术来保证SAML声明传递的安全性。通过在J2EE平台上实现，证明了该模型可以很好地解决Browser/Artifact方式传递SAML声明存在的安全性问题。

Research and implementation of security SSO authentication model based on SAML and XKMS

For the security problem existing in the process of SSO which used Browser/Artifact mode, this paper designed a security SSO authentication model based on SAML and XKMS. It used a key management layer which combined traditional PKI with XKMS to provide the key management service, at the same time, this model applied XML digital signature technology and XML encryption technology to ensure the security of sending SAML statement message. Through the implementation on the platform of J2EE,the result proves that the security SSO model can be a very good solution to the security problem in the deli-very of SAML statement by Browser/Artifact mode.