Research Of Cross-domain Authentication And Authorization

With the development of internet and the distributed computing ability,it is possible for the resource sharing in extensiveness district.Economic development allows businesses to be more detailed division by work.Cooperation between enterprises through the network,information exchange and resource sharing became more and more frequent.Security is a very important issue they must pay attention to, authentication and access authorization is the first two problems they need to solve in security sphere.Now,most of the authentication systems in current network environment are based on Username/Password and only used in an organization,and it is known that Username/Password is not very safe sometimes.The authorization mechanism is usually based on ACL or RBAC,but the concrete way of realization and defination is different among different organizations,so it is only used in a single organization or enterprise.So,if we want to build a cross-domain authentication and authorization systen between different organizations,there are a lot of problems need to be solved.This thesis is focused on solving such problems,such as identity provider discovery problem in cross-doman authentication and the interoperability in transfer attribute information between different domains in cross-doman authorization.After some discussion of this.problems,we implement a cross-domain authentication and authorization system which can support three common authorization mechanism.The system use certificate and a mediating system in solveing cross-domain authentication problems,and use an attribute mapping mechanism in solving cross-domain interoperability problems.To ensure the security in the information exchange between domains,this system use SAML(Security Assertion Markup Language) to transfer cross-domain authentication and authorization information and use digital certificate to sign the SAML request and response messages.At the end of this thesis,an application demonstration was used to show the function of this cross-domain system.