Abstract: Single sign-on is techniques which can overcome disadvantages of traditional authentication mechanism in service integration process，and is also a key issue must be investigate in multi-service operation system.After comparing many single sign-on schemes，especially the scheme based on SAML model，provides a single sign-on model based on dual-token mechanism.Besides SAML token，the model introduces session key and session token，and uses local session dynamic active algorithm，meets the demands in security and efficiency.

Key words: single sign-on, security assertion markup language, SAML token, session key, session token, dynamic active algorithm

摘要： 单点登录技术克服了业务整合过程中传统认证机制不足，是多业务运营平台需要重点研究的问题之一。对多种单点登录解决方案进行比较，重点分析安全断言标记语言（SAML）模型，提出一种基于双令牌机制的改进单点登录模型。模型在应用SAML令牌作为用户身份载体基础上，引入会话密钥和会话令牌，并采用本地会话缓存周期动态激活算法，满足了运营平台对认证授权体系整体安全性和处理效率等方面的要求。

关键词: 单点登录, 安全断言标记语言, SAML令牌, 会话密钥, 会话令牌, 动态激活算法