0引言本文在研究一次性口令认证机制的基础上,将一次性口令认证应用到Kerberos协议的初始认证阶段,在没有增加Kerbero认证会话次数的前提下,有效解决了Kerberos协议存在的易于遭受口令猜测攻击和重放攻击的问题。实验结果显示,该方案不仅增强了Kerberos的安全性,而且效率相比PKINIT有了较大的提升,初始认证服务交互时间减少了32.3%。 0 Introduction This paper studies the one-time password authentication mechanism, based on the one-time password authentication is applied to the Kerberos protocol during the initial authentication phase without increasing the number of Kerbero authentication session under the premise of effectively solve the Kerberos protocol is vulnerable to password guessing Attack and replay attacks. Experimental results show that the proposed scheme not only enhances the security of Kerberos, but also improves the efficiency compared with PKINIT. The time of initial authentication service interaction is reduced by 32.3%.