关键词: 虚拟企业, 异构域, 认证密钥协商, 访问授权票据

Abstract: To satisfy the safe and effective sharing of virtual enterprises in heterogeneous domain,a heterogeneous cross-domain authenticated key agreement scheme based on access authorization tickets was proposed.The first-tier trust relationship between Certificate Authority (CA) in PKI domain and Authentication Server (AS) in Kerberos domain by using public key crypto system-based distributed trust model was established.On this basis,the access authorization tickets generated by CA (or AS together with ticket granting service) was distributed to external domain U to access internal domain S,and the second-tier trust relationship between U and S was built by designing two-way cross-domain authenticated key agreement protocol based on symmetry-key system.The security of the new scheme was proved by SVO logic.The analysis showed that the public key cryptographic operations could be entirely avoided for the end users or resources in Kerberos domains,which had better implementation in heterogeneous cross-domain identity authentication process.

Key words: virtual enterprise, heterogeneous domain, authenticated key agreement, access authorization ticket