SESAME V2 public key and authorisation extensions to Kerberos

There are increasing requirements for the availability of practical solutions to the problem of providing secure single sign-on for users to applications anywhere on a network, but with affordable security management. Kerberos has been proven to be an effective solution to this problem for a local network, or within closely linked groups of users, but Kerberos is constrained by its current limitations of supporting purely symmetric key distribution, and an identity-based authorisation model. This paper describes how the SESAME (Secure European System for Applications in a Multi-vendor Environment) project has integrated asymmetric key distribution, and authorisation support to extend Kerberos to provide significant scalability and manageability improvements.<
>