Oracle Database Advanced Security 10g Release 1, Руководство администратора

Страница: 495 / 518

Glossary-13
KDC
Key Distribution Center. In Kerberos authentication, the KDC maintains a list of
user principals and is contacted through the
kinit
(
okinit
is the Oracle version)
program for the user's initial ticket . Frequently, the KDC and the Ticket Granting
Service are combined into the same entity and are simply referred to as the KDC.
The Ticket Granting Service maintains a list of service principals and is contacted
when a user wants to authenticate to a server providing such a service. The KDC is
a trusted third party that must run on a secure host. It creates ticket-granting tickets
and service tickets.
Kerberos
A network authentication service developed under Massachusetts Institute of
Technology's Project Athena that strengthens security in distributed environments.
Kerberos is a trusted third-party authentication system that relies on shared secrets
and assumes that the third party is secure. It provides single sign-on capabilities
and database link authentication (MIT Kerberos only) for users, provides
centralized password storage, and enhances PC security.
key
When encrypting data, a key is a value which determines the ciphertext that a given
algorithm will produce from given plaintext. When decrypting data, a key is a value
required to correctly decrypt a ciphertext. A ciphertext is decrypted correctly only if
the correct key is supplied.
With a symmetric encryption algorithm, the same key is used for both encryption
and decryption of the same data. With an asymmetric encryption algorithm (also
called a public-key encryption algorithm or public-key cryptosystem), different
keys are used for encryption and decryption of the same data.
key pair
A public key and its associated private key . See public and private key pair
keytab file
A Kerberos key table file containing one or more service keys. Hosts or services use
keytab files in the same way as users use their passwords.
kinstance
An instantiation or location of a Kerberos authenticated service. This is an arbitrary
string, but the host machine name for a service is typically specified.