系统到系统身份验证（双因素）最佳模型（具有最高标准/政府机构签字）？
总之，
我正在为一个系统（我们的）构建一个接口，其中包含敏感数据，现在必须通过（我们自己设计的）系统接口将这些数据提供给将构建到客户的其他系统中的数据。
场景：- SystemB 调用 SystemA.NewInterface.getData()，其中 SystemA 是预先存在的（我们的），SystemB 是经过身份验证的授权调用者。
问题集中在：哪种身份验证机制比较好？
当然会使用标准网络级安全性（SSL/TLS、端口阻塞、IP 地址过滤） 。但 IP 地址可能会被欺骗。流动的数据将被混淆（以保护数据收集者的敏感性和匿名性），但在批量获取时仍然非常有价值。
无法向调用系统颁发证书。
我有一个双因素（ish）身份验证系统的计划/设计/cgarette数据包视图，该系统以密钥交换为模型，非常类似于“Diffie-Hellman”（关于 Diffie-Hellman 的维基百科），但它的参与度足够高，以至于业务人员可能会质疑它的适用性。有效的问题，有效的答案非常技术性。
我认为企业不会理解这种技术选择/计划的原因。
在受监管的世界（政府、军事、医疗监管机构）中不使用证书的系统->系统接口的身份验证是否有任何全球或国家指南或标准？
如果我可以引用全球组织/标准委员会或监管机构的标准，那么我会很乐意使用（扩展？）该模式......然后企业就可以知道它不仅仅是技术“巫术”/烟雾和镜子。
非常感谢您的帮助！
艾达纳普词
All,
I am building an interface for a system (ours) that contains sensitive data that must now be made available through a system interface (of our own design) to what will be built into a client's other systems.
Scenario :- SystemB calls SystemA.NewInterface.getData() where SystemA is the pre-existing one (ours) and SystemB is an authenticated authorised caller.
The question centres on: What authentication mechanism is a good one here?
Standard network level security (SSL/TLS, port blocking, IPAddress filtering) will, of course, be used. But IP addresses can be spoofed. The data that flows will be obfuscated (to protect sensitivity and anonymity of persons from whom the data was collected) but is nonetheless very valuable when obtained in bulk.
Issuing certificate(s) to the calling system is not an option.
I have a plan/design/cgarette packet view for a Two-factor (ish) authentication system that is modelled on the key exhange much like 'Diffie-Hellman' (wikipedia on Diffie-Hellman) but it is involved enough that the business people might ask questions of it's suitability. Valid questions where the valid answers are very technical.
I do not think the business will understand the reasons for such a technical choice/plan.
Are there any global or national guidelines or standards for authentication for system->system interfaces that do not use certificates in the regulated world (govt, millitary, medical regs)?
If I can cite a standard by a global org/standards commitee or a regulatory body then I will gladly use (extend?) that pattern ... then the business can know it is more than just technical 'wizardry'/smoke&mirrors.
Big thanks for the help!
Aidanapword
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
听起来你正在尝试解决一个不可能的问题。无论您使用什么技术，某人都必须提供只有他们自己才能提供的信息才能确认其身份。密码是最简单的形式，但并不是特别安全。如果您无法使用密钥对，我不确定您还有什么其他选择。如果他们担心成本，您可以使用自签名证书。
It sounds like you're trying to solve an impossible problem. No matter what technology you use, someone must supply a piece of information only they can supply in order to confirm their identity. A password is the simplest form but is not particularly secure. I'm not sure what other options you have if you can't use a key pair. You can use a self signed certificate if the cost is what they're concerned about.