Abstract: Kerberos is an identity authentication system widely used in cloud computing, Internet of Things and other scenarios. The database of its key distribution center stores the clear key information. In the distributed environment, there are storage management, memory leakage and other security risks, which affect the security of the identity authentication system. Therefore, a Kerberos security enhancement scheme based on Intel SGX is proposed. The key using module in the process of key initialization and identity authentication is moved to the Enclave, and the key is protected dynamically by the memory isolation mechanism supported by hardware. Seals storage to a database in a secure area based on a sealing mechanism. Experiments show that the scheme can guarantee the confidentiality and integrity of the dynamic and static keys and reduce the range of the trusted computing basis. The performance evaluation shows that the proposed scheme can guarantee the security of key operation and storage while the extra cost of performance is also acceptable.

Key words: Intel SGX, Kerberos, identity authentication, key management, security

摘要： Kerberos是广泛应用于云计算，物联网等场景下的身份认证系统，其密钥分发中心（key distribution center, KDC）的数据库存储着明文的密钥信息，在分布式环境中具有存储管理、内存泄露等安全隐患，进而影响身份认证系统的安全.因此提出基于Intel SGX（software guard extensions）的Kerberos安全增强方案，将密钥的初始化和身份认证流程中涉及密钥使用模块迁移至SGX提供的安全隔离区域Enclave中，通过基于硬件支持的内存隔离机制动态保护密钥；在安全区内使用密封机制密封存储至数据库.通过实验证明了本方案能够保障密钥动态和静态的机密性和完整性，减小了可信计算基础的范围.而性能评估显示, 本文方案在保障密钥运行和存储安全的同时，性能的额外开销也在可接受范围之内.

关键词: Intel SGX, Kerberos, 身份认证, 密钥管理, 安全