To solve the problem of security threat spread in Security Assertion Markup Language(SAML) Single Sign-on(SSO), an user-centric SSO protocol based proxy signature is presented in this paper. An access control mechanism is added to the protocol, which restricts the scope of services being visited by user and limits time span that user can access. Security is analyzed in random oracle model, and results show that this protocol can resist the replay attack of identity notes and access token.%针对安全断言标记语言单点登录过程中存在的用户安全风险扩散问题,提出一种以用户为中心基于代理签名的单点登录协议.在建立安全会话时加入访问控制机制,以限定用户单点登录访问服务的时间和范围.对协议的安全性进行分析,结果表明,该协议能抵抗身份票据和访问令牌的重放攻击.
展开▼
