Abstract: This paper analyzes the problems of the password guessing dictionary attacks and message replay attacks in current Kerberos protocol. An improved single sign-on protocol is proposed. The prevention of password guessing dictionary attacks is achieved by adding a random number and employing a dynamic key in authentication messages. The resistance of replay attacks is realized by marking the message between a client and its corresponding server with a unique serial number. Experimental results show that the improved protocol is valid.

Key words: single sign-on, Kerberos protocol, dictionary attack, replay attack

摘要： 现有Kerberos协议易受密码猜测字典攻击和报文重放攻击。为此，提出一个改进的Kerberos单点登录协议。在认证报文中添加随机数并使用动态密钥，防止密码猜测字典攻击，为每个报文添加一个唯一的序列号，防止报文重放攻击。实验结果证明了改进协议的有 效性。

关键词: 单点登录, Kerberos协议, 字典攻击, 重放攻击

CLC Number: 

• TP309