- 學位論文
一個可擴充的分散式單一簽入系統
An Extendable Distributed Single Sign-On System
摘要
隨著網際網路的普及，各企業也陸續地推出網路化的服務。由於不同功能的服務網站需要不同水準的安全性，因此各網站所採用之認證機制並不一致，導致每次存取不同的網站時都必須重新進行認證，造成使用者的不便。 為了解決上述之問題，學者們提出了單一簽入（Single Sign-On）的概念，讓使用者經過一次身分認證後，即可存取所有的網站。為了實踐此一概念，必須建置一套網站存取控制系統，代替使用者通過網站之身分認證。在認證技術方面，本研究提出一個結合代登入與認證交談之執行架構，並搭配可擴充式的軟體架構設計，能夠支援最廣為採用之Token-Based以及Challenge-Response認證機制，同時因應不斷推陳出新的認證技術。由於該系統介入既有網站之存取，本研究採用叢集架構並搭配軟體負載平衡技術。除了提供系統能力（Capacity）之延展性，並避免系統成為效能瓶頸之外，更簡化了叢集節點所需之執行平台，進而降低系統能力之擴充成本。
並列摘要
With the popularity of the Internet, enterprises also launched web-based services one after another. Since different functions of websites requiring different level of security, each website uses different authentication mechanism, resulting in user inconvenience. In order to solve above problem, scholars have proposed the concept of single sign-on. It makes a user able to access every website after authenticated by system. The implementation requires building a website access control system to pass through authentication for user. On the technical side of authentication, this paper proposes an execution architecture that combined agent signing and authentication negotiation with extendable software architecture. It supports the most widely used token-based and challenge-response authentication, and also cope with the continuous innovation of authentication technology. Since involving in website access, this thesis uses cluster architecture with application-level load balancing. In addition to providing scalability of capacity and to avoid becoming performance bottlenecks, it also reduces the expansion costs of system capacity.