• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.11b
• /
• pp.1063-1066
• /
• 2002

최근 개방형 분산 네트워크 상의 강력한 인증 시스템으로 MIT 에서 개발된 Kerberos 인증 메커니즘이 많이 쓰이고 있다. Kerberos 는 비밀키 기반의 DES 알고리즘에 기반을 둔 인증 시스템으로 보편화된 인증 방법들을 우회하는 공격과 보다 넓은 네트워크 환경에 적합한 인증 시스템을 염두에 두고 개발되었다. 많은 DES의 최신 버전에서는 서비스 패키지를 통해 Kerberos를 제공하고 있으나 복잡한 인증 정보 및 인증 단계를 손쉽게 사용할 수 있도록 하는 관리 툴은 많이 개발되지 않은 상태이다. 또한 분산 네트워크 서비스에서 인증 시스템을 사용할 때 여러 대의 인증 시스템으로 인증 서비스를 지원해야 하는데 그 인증 시스템을 관리할 때마다 로컬 인증 시스템에 직접 작업을 해야하는 불편이 따르며, 또 관리 시 원격에서 접속할 때 OS 패키지 마다 지원해주는 인증 관리 인터페이스는 사용할 수가 없다. 따라서 본 논문에서는 Kerberos 의 인증 메커니즘을 소개하며 또 Kerberos 의 인증 메커니즘을 이용하여 원격에서도 인증 관리 인터페이스를 통해 인증 관리를 할 수 있는 인증 관리 인터페이스를 JAVA로 설계하여 손쉽게 Kerberos를 관리할 수 있는 방법을 제시한다.

• Journal of the Korea Society of Computer and Information
• /
• v.11 no.3
• /
• pp.57-66
• /
• 2006

In this paper. proposes Multi_Kerberos certification mechanism that improve certification service of based on PKINIT that made public in IETF CAT Working Group. This paper proposed to a certificate other realm because search position of outside realm through DNS and apply X.509 directory certification system, to get public key from DNS server by chain (CertPath) between realms by certification and key exchange way that provide service between realms applying X.509, DS/DNS of based on PKINIT, in order to provide regional services. This paper proposed mechanism that support efficient certification service about cross realm including key management. the path generation and construction of Certificate using Validation Server, and recovery of Session Key. A Design of Multi_Kerberos system that have effects simplify of certification formality that reduce procedures on communication.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.15 no.3
• /
• pp.53-64
• /
• 2005

In this paper, proposes Kerberos certification mechanism that improve certification service of PKINIT base that announce in IETF CAT Working Croup. Also proposed Authentication Mechanism for reusability of Ticket that after Ticket's Lifetime is ended, message exchange that Local Client receives Remote Server's service. Since my suggestion to regional services are not described in Kerberos, authentication between regions can be performed via PKINIT(Public Key Cryptography for Initial Authentication) presented by IETF(Internet Engineering Task Force) CAT working group. The new protocol is better than the authentication mechanism proposed by IETF CAT Working group in terms of communication complexity and mechanism according to simplified Ticket issue processing.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.12 no.2
• /
• pp.123-133
• /
• 2002

In Network Environment, Kerberos certification mechanism to require Kerberos server in other area unconditionally belief. Also, Kerberos server in cooperation area must be share server of other area and secret key. To solve these two problems, this paper proposed safe security mechanism of doing to ably IETF CAT's PKINIT/PKCROSS a1gorithm with Public Key Infrastructure and use Directory System and service between realms do trust and prove each Kerberos trust center base. Also, Although Kerberos server of each area must be foreknowing each server's secret key and public key, Obtain through Trust center and acquire each area's public key and common symmetric key, Application server excluded process that must register key in Key Distribution Center.

• Journal of the Korea Computer Industry Society
• /
• v.3 no.5
• /
• pp.641-652
• /
• 2002

In this paper, proposes Kerberos certification mechanism that improve certification service of PKINIT base that announce in IETF CAT Working Group. Bid to certificate other realm because search position of outside realm through DNS and apply X.509 directory certification system, acquire public key from DNS server by chain (CertPath) between realms by certification and Key exchange way that provide service between realms applying X.509, DS/DNS of PKINIT base. In order to provide regional services, Certification and key exchange between realms use Kerberos symmetric method and Session connection used Directory service to connection X.509 is designed using an asymmetric method. By efficient TGT (Ticket Granting Ticket) exchange and reusability of ticket, A Design of Kerberos system that have effect and simplification of certification formality that reduce overload on communication.

• The KIPS Transactions:PartC
• /
• v.9C no.3
• /
• pp.313-322
• /
• 2002

In this paper, proposes Kerberos certification mechanism that improve certification service of PKINIT base that announce in IETF CAT Working Ggroup. Did to certificate other realm because search position of outside realm through DNS and apply X.509 directory certification system, acquire public key from DNS server by chain (CertPath) between realms by certification and Key exchange way that provide service between realms applying X.509, DS/BNS of PKINIT base. In order to provide regional services, Certification and key exchange between realms use Kerberos' symmetric method and Session connection used Directory service to connection X.509 is designed using an asymmetric method. Excluded random number ($K_{rand}$) generation and duplex encryption progress to confirm Client. A Design of Kerberos system that have effect and simplification of certification formality that reduce Overload on communication.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.11b
• /
• pp.1177-1180
• /
• 2002

본 논문에서는 IETF CAT Working Group에서 발표한 PKINIT기반의 인증서비스를 향상시킨 Kerberos 인증 메커니즘을 제안한다. PKINIT기반의 X.509, DS/DNS를 적용하여 영역간의 서비스를 제공하는 인증과 키 교환방식으로 DNS를 통해 외부영역의 위치를 탐색하고 X.509 디렉토리 인증 시스템을 적용, 영역간 인증은 DNS 서버로부터 공개키를 획득하여 다른 영역을 인증하도록 하였다. 영역간 인증과 키 교환은 Kerberos의 관용키 암호방식을 사용하고 세션 연결은 X.509 공개키 방식에 기반을 두고 있다. 효율적인 TGT(티켓승인 티켓) 교환과 통신상의 Overload를 감소시키는 효과와 인증절차의 간소화를 가지는 Kerberos시스템을 설계하였다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.8 no.7
• /
• pp.1516-1523
• /
• 2004

In the paper, an algorithm fitted to P2P system was proposed by improving Kerberos which is an algorithm for mutual authentication. To keep the role of Kerberos and minimize load to server, the proposed algorithm imposed the server role of ticket recognition to the opposite peer. Using this method, the number of sewers as ticket recognition server was averted and function of server for authentication was minimized so that server load was mininized. The proposed algorithm enables the server to play the minimum of the role and to perform strong mutual authentication, while imposeing on the peers the role of authentication. To make suitable to P2P system, trial number oriented authentication limit was given, not time-oriented authentication expiration time. In the paper, a new P2P system was designed using this algorithm.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.11b
• /
• pp.881-884
• /
• 2002

Kerberos 시스템은 MIT에서 Athena 프로젝트의 일환으로 개발된 인증 시스템으로 인증되지 않은 사용자들의 불법 접속을 방지하고, 인증된 사용자에게 서비스 이용 권한을 제공하려는 목적을 가지고 있다. 이 시스템은 인증 서버(AS: Authentication Server)와 티켓 승인 서버(TGS: Ticket Granting Server) 그리고 서비스 제공 서버(SPS; Service Provide Server)로 구성된다. 사용자는 서비스 제공 서버와 관용 암호 알고리즘에 사용할 비밀키를 공유하고, 이를 이용하여 서비스를 제공받는다. 본 논문에서는 키 복구 기능과 향상된 인증 서비스를 제공하는 Kerberos 시스템을 제안한다. 제안하는 시스템은 사용자와 서비스 제공 서버간에 키 분배를 수행하고, 서비스 제공 서버는 분배된 키를 이용하여 서비스를 제공한다. 이때 분배된 키는 사용자의 요청에 따라 인증 서버와 티켓-승인 서버에 의해 복구될 수 있다.

• The KIPS Transactions:PartC
• /
• v.10C no.3
• /
• pp.287-294
• /
• 2003

Authentication and authorization are essential functions for the security of distributed network environment. Authorization is determining and to decide whether a user or process is permitted to perform a particular operation. In this paper, we design an authorization mechanism to make a system more effective with Kerberos for authentication mechanism. In the authorization mechanism, Kerberos server operates proxy privilege server. Proxy privilege server manages and permits right of users, servers and services with using proposed algorithm. Also, privilege attribute certificate issued by proxy privilege server is used in delegation. We designed secure kerberos with proposed functions for effective authorization at the same time authentication of Kerberos mechanism.