Abstract: A new cross heterogeneous domain authentication model based primarily on PKI is proposed. Detailed authentication processes are designed when users access resources across heterogeneous domains in different domains. Cross-domain authentication between PKI and Kerberos domains can be accomplished, and mutual authentication is supported. Analysis was conducted on the protocol model. Theoretical analysis shows that the proposed scheme has good compatibility, expansibility, reliability, parallelism, and security. Thus, this model is suitable for PKI-based large-scale network environments for achieving cross-domain authentication between PKI and Kerberos domains.