SSO password-based multi-server authentication protocol

Abstract

User's password verification information stored on the server is main point of vulnerability and remains attractive target for attacker. Proposed protocol uses two-server architecture so that password verification information is distributed between two servers known as authentication server and control server. In this paper, we present single sign-on (SSO) password-based multi-server authentication protocol that issues the ticket to the user for a specific time period. Ticket issued for one authentication server can be used by the peer user for its authentication to another authentication server that is under the control of same control server. It distributes password verification information between the authentication server and the control server based on peer-to-peer (P2P) computing. Therefore, the proposed protocol is more resistant to dictionary attack as compared to existing single-server password based authentication protocols. The proposed protocol does not use public key that causes computation and communication burden in resource constraint environment.