Layering Central Authentication on Existing Distributed System Terminal Services: (Revision 2).

摘要

Provision of terminal service in a distributed system requires mechanisms to logon and logoff as well as to move textual data between the terminal and remote host. Logon occurs in most distributed systems subsequent to the establishment of a terminal session by means of host specific logon procedures. However, in a distributed system of any size, this approach leads to security and password management problems. When the distributed system is centrally administered, these problems can be rectified through the use of a central authentication service that presents a common logon interface to the user for all distributed system hosts. Normally, central authentication is provided by either initially designing it into a distributed system or supporting it through the modification of distributed system and host operating system software. As an alternative strategy, central authentication can be layered onto existing terminal services. This approach suggests itself when a large installed base of computer systems that do not support central authentication already exists. Work to assess the feasibility of this approach was carried out. The results demonstrate that layering can be used in certain circumstances to provide central authentication services, although, as a result, the concomitant maintenance costs may increase. It was also determined what terminal service features are necessary so that central authentication is easily layered on existing terminal services. Recommendations are made concerning how to structure terminal services in a distributed system to support an integrated central authentication service. 15 refs., 5 figs. (ERA citation 14:027770)