Federated Identity Research Articles

Evaluating single sign-on security failure in cloud services

Business use of cloud computing services is motivated by ease of use and potential financial cost reductions. Service failure may occur when the service provider does not protect information or when the use of the services becomes overly complex and difficult. The benefits of cloud computing also bring optimization challenges for the information owners who must assess service security risks and the degree to which new human behaviors are required. In this research, we look at the risk of identity theft when ease of service access is provided through a single sign-on (SSO) authorization, asking: What are the optimal behavioral expectations for a cloud service information owner? Federated identity management provides well-developed design literature on strategies for optimizing human behaviors in relation to the new technologies. We briefly review the literature and then propose a working solution that optimizes the trade-off between disclosure risk, human user risk, and service security.

Lightweight CoAP-Based Bootstrapping Service for the Internet of Things.

The Internet of Things (IoT) is becoming increasingly important in several fields of industrial applications and personal applications, such as medical e-health, smart cities, etc. The research into protocols and security aspects related to this area is continuously advancing in making these networks more reliable and secure, taking into account these aspects by design. Bootstrapping is a procedure by which a user obtains key material and configuration information, among other parameters, to operate as an authenticated party in a security domain. Until now solutions have focused on re-using security protocols that were not developed for IoT constraints. For this reason, in this work we propose a design and implementation of a lightweight bootstrapping service for IoT networks that leverages one of the application protocols used in IoT : Constrained Application Protocol (CoAP). Additionally, in order to provide flexibility, scalability, support for large scale deployment, accountability and identity federation, our design uses technologies such as the Extensible Authentication Protocol (EAP) and Authentication Authorization and Accounting (AAA). We have named this service CoAP-EAP. First, we review the state of the art in the field of bootstrapping and specifically for IoT. Second, we detail the bootstrapping service: the architecture with entities and interfaces and the flow operation. Third, we obtain performance measurements of CoAP-EAP (bootstrapping time, memory footprint, message processing time, message length and energy consumption) and compare them with PANATIKI. The most significant and constrained representative of the bootstrapping solutions related with CoAP-EAP. As we will show, our solution provides significant improvements, mainly due to an important reduction of the message length.

Federated identity management in e-government: lessons learned and the path forward

Management of digital identity involves every company and institution, not only in the internet world. Among different identity management models, only the federated one is able to ensure a strong protection in terms of trust and privacy. In fact, the participants in the federation decide to trust each other about which information can be exchanged in the processes of authentication and authorisation, based on established policies to manage relationships of trust. According to this, it has been widely adopted during the last years. In particular, its adoption in Public Administration allows a proper organisation autonomy, supporting access to the services offered by the institution. This process is going to quickly raise with the progressive adoption of cloud computing by Public Administrations. In the paper, two projects accomplishing federated digital identity in Italian Public Administrations are presented. Starting from lessons learned, authors highlight a path forward for Public Administration toward federated digital identity in cloud computing scenario.

Using Screen Brightness to Improve Security in Mobile Social Network Access

In the today's mobile communications scenario, smartphones offer new capabilities to develop sophisticated applications that seem to make daily life easier and more convenient for users. Such applications, which may involve mobile ticketing, identification, access control operations, etc., are often accessible through social network aggregators, that assume a fundamental role in the federated identity management space. While this makes modern smartphones very powerful devices, it also makes them very attractive targets for spyware injection. This kind of malware is able to bypass classic authentication measures and steal user credentials even when a secure element is used, and can, therefore, perform unauthorized mobile access to social network services without the user's consent. Such an event allows stealing sensitive information or even a full identity theft. In this work, we address this issue by introducing BrightPass, a novel authentication mechanism based on screen brightness. BrightPass allows users to authenticate safely with a PIN-based confirmation in the presence of specific operations on sensitive data. We compare BrightPass with existing schemes, in order to show its usability and security within the social network arena. Furthermore, we empirically assess the security of BrightPass through experimentation. Our tests indicate that BrightPass protects the PIN code against automatic submissions carried out by malware while granting fast authentication phases and reduced error rates.

Providing efficient SSO to cloud service access in AAA-based identity federations

The inclusion of cloud services within existing identity federations has gained interest in the last years, as a way to simplify the access to them, reducing the user management costs, and increasing the utilization of the cloud resources. Whereas several federation technologies have been developed along the years for the Web world (e.g. SAML, Oauth, OpenID), non-web application services have been largely forgotten. The ABFAB IETF WG was created to define an architecture and a set of technologies for providing identity federation to non-Web application services, such as the cloud. ABFAB provides a way to use the existing EAP/AAA infrastructure to perform federated access control to any kind of application service, thanks to the definition of a new GSS-API mechanism called GSS-EAP. However, the ABFAB architecture does not define an efficient way of providing SSO. This paper defines a way to include such an SSO support into ABFAB, by introducing the required extensions to make use of the EAP Re-authentication Protocol (ERP), the IETF standard for providing fast re-authentication in EAP. Moreover, to demonstrate the feasibility of the proposed extensions, we have implemented a proof-of-concept based on Moonshot, the open-source implementation of ABFAB, and OpenStack as an example of cloud service. Finally, using this prototype we have completed a performance analysis that compares our proposal with the standard ABFAB operation. This analysis confirms the substantial reduction in terms of computational time and network traffic that can be achieved using ERP for providing efficient SSO to cloud service access in ABFAB-based identity federations.

Identity federation in OpenStack - an introduction to hybrid clouds

We are evaluating cloud identity federation available in the OpenStack ecosystem that allows for on premise bursting into remote clouds with use of local identities (i.e. domain accounts). Further enhancements to identity federation are a clear way to hybrid cloud architectures - virtualized infrastructures layered across independent private and public clouds.

Towards Scalability for Federated Identity Systems for Cloud-Based Environments

As multi-tenant authorization and federated identity management systems for cloud computing matures, the provisioning of services using this paradigm allows maximum efficiency on business that requires access control. However, regarding scalability support, mainly horizontal, some characteristics of those approaches based on central authentication protocols are problematic. The objective of this work is to address these issues by providing an adapted sticky-session mechanism for a Shibboleth architecture using JASIG CAS. This alternative, compared with the recommended distributed memory approach, shown improved efficiency and less overall infrastructure complexity, as well as demanding less 58% of computational resources and improving throughput (requests per second) by 11%.

Secure Inter-Cloud Federated Identity Management using IID

The proposed system support single sign on in inter-cloud environment where user can manage in different cloud environments and provide single set of credential to access different Saas cloud application provided by different cloud service provider without re-authentication. Single sign on defines the ability to authenticate only once in a distributed network and to access several protected services and resources without re-authentication. To achieve this feature the system support federated identity management system. The federated identity management system crosses organizational boundaries. To manage identities of user in this case, a cooperative contract need to be set up between multiple identity providers, using a centralized approach. The proposed system uses third party auditor or third cloud to synchronize the identities of user among different clouds. As the user data are transferred or exchanged between different clouds environment the chances of stealing the data is increased. To avoid this the system is secure from some attacks like identity theft, denial of service etc. and also secure channel is maintained to transfer/exchange information between

Globus Nexus: A Platform-as-a-Service provider of research identity, profile, and group management

Globus Nexus is a professionally hosted Platform-as-a-Service that provides identity, profile and group management functionality for the research community. Many collaborative e-Science applications need to manage large numbers of user identities, profiles, and groups. However, developing and maintaining such capabilities is often challenging given the complexity of modern security protocols and requirements for scalable, robust, and highly available implementations. By outsourcing this functionality to Globus Nexus, developers can leverage best-practice implementations without incurring development and operations overhead. Users benefit from enhanced capabilities such as identity federation, flexible profile management, and user-oriented group management. In this paper we present Globus Nexus, describe its capabilities and architecture, summarize how several e-Science applications leverage these capabilities, and present results that characterize its scalability, reliability, and availability.

Digital Identity Management

In the past four decades, information technology has altered chains of value production, distribution, and information access at a significant rate. These changes, although they have shaken up numerous economic models, have so far not radically challenged the bases of our society. This book addresses our current progress and viewpoints on digital identity management in different fields (social networks, cloud computing, Internet of Things (IoT)), with input from experts in computer science, law, economics and sociology. Within this multidisciplinary and scientific context, having crossed analysis on the digital ID issue, it describes the different technical and legal approaches to protect digital identities with a focus on authentication systems, identity federation techniques and privacy preservation solutions. The limitations of these solutions and research issues in this field are also discussed to further understand the changes that are taking place. Offers a state of the discussions and work places on the management of digital identities in various contexts, such as social networking, cloud computing and the Internet of Things Describes the advanced technical and legal measures to protect digital identities Containsa strongemphasis of authentication techniques, identity federation tools and technical protection of privacy

Relationship-based federated access control model for EPC Discovery Service

EPCglobal network was designed aiming at sharing information and increasing interoperability, effectiveness and visibility of the supply chain networks via RFID-enable technologies, open architecture, and item-level data query. Since the network needs to manage billions of nodes, machines and users with sensitive information stored in distributed heterogeneous databases from multiple parties, a secured global scaled EPC Discovery Service (EPCDS) system is needed for managing and facilitating the communications among participants. EPCDS is responsible for distributing as well as retrieving the target data. On one hand, it serves as an information sharing bridge among different entities; on the other hand, many of these shared information are business sensitive, and thus cannot be shared without control. Security and privacy has been a major concern for EPCDS. The most critical problem exists when entities have independent but conflict security needs, known as interdependent security threat. In this paper we propose a relationship-based federated access control model to solve the interdependent security problem. The effectiveness of this model is ensured by the proposed decision aggregation rule, which computes individual entity's security decision into a holistic network decision. Our proposed model distinguishes itself from previous works in that it is the first paper that examines in details the interdependent security threat and its countermeasure under the EPCDS network context. The model satisfies all the six key requirements discussed in the paper. Moreover, the access control enforcements are implemented at both EPCIS and the EPCDS levels, which satisfy the security demands of each individual entity as well as the supply network as a whole.

Managing Dynamic Identity Federations using Security Assertion Markup Language

Security Assertion Markup Language is one of the most widely used technologies to enable Identity Federations among different organisations. Despite its several advantages, one of its key disadvantages is that it does not allow creating a federation in a dynamic fashion to enable service provisioning (or de-provisioning) in real time. A few approaches have been proposed to rectify this problem. However, most of them require elaborate changes of the language and do not provide mechanisms to manage federations dynamically. This paper presents a better approach based on an already drafted Security Assertion Markup Language Profile and requires no change in its specification, rather it depends on the specific implementation. Our proposed approach covers all aspects regarding the management of dynamic Identity Federation. It will allow users to create federations dynamically between two prior unknown organisations and will allow them to manage such federations as long as it is required. Implicit in each identity federation is the issue of trust. Therefore, the trust issues involved in the management of dynamic federations are analysed in details. Finally, a proof of concept is discussed with a few use-cases to elaborate the practicality of our approach.

Blended Identity: Pervasive IdM for Continuous Authentication

A proper identity management approach is necessary for pervasive computing to be invisible to users. Federated identity management is key to achieving efficient identity blending and natural integration in the physical and online layers where users, devices, and services are present.

Towards Better AAA in Identity Federations

ABSTRACTMany organizations have adopted SAML-based identity federation as a standard component of their enterprise architecture. A service provider in a federation may be viewed as a combination of an assertion consumer service (ACS) responsible for interactions with other federation participants (such as identity providers, or IDPs) and an application that provides useful functionality to end users. More often than not assertion consumer services are shared among multiple applications, but the current usage only exposes the ACS’s name to other parties in the federation, not the names of the applications. Identity providers in higher assurance federations frequently provide authentication, authorization, and accounting (AAA) services with application-level granularity, and this usage pattern prevents them from knowing the applications on whose behalf federation requests are made. In this article we propose a solution that enables an ACS to generate, and an IDP to consume, this missing information. Our approach is to extend the existing SAML 2.0 proxying capability by allowing references to applications that participate in the SAML ecosystem but do not support SAML themselves. We conclude that simple changes in information technology practices (supported by the necessary enhancements in vendor products) can significantly improve application-level AAA in environments with shared assertion consumer services.

ACCFLA: Access Control in Cloud Federation using Learning Automata

Behnaz Seyed Taheri Department of Computer Engineering, Mahallat Branch, Islamic Azad University, Mahallat, Iran Mostafa Ghobaei Arani Department of Computer Engineering, Parand Branch, Islamic Azad University, Tehran, Iran Mehrdad Maeen Department of Computer Engineering, Yadegare Imam Khomeini (RAH) Branch, Islamic Azad University, Tehran, Iran ABSTRACT In recent years, cloud computing has been applied increasingly and most of the companies, have considered some kinds of cloud strategies to use in their organizations. Growing request for services causes overload on a single cloud. Cloud federation is an ideal solution to overcome continuous increasing requests by users. Identity management and access control are from challenging subjects of cloud federation which for has been offered approaches like identity federation, although it is not an optimum approach. There is needed a more effective, accurate and safe approach. This paper offered an approach to access control based on risk and trust parameters, depending on learning automata in cloud federation. Results of simulation shows that proposed approach prevents access of unauthorized user to the resources of federation by decreasing primary trust for novice user also by increasing risk for high sensitive resources.

Logout in single sign-on systems: Problems and solutions

Web single sign-on (SSO) systems enable users to authenticate themselves to multiple online services with one authentication credential and mechanism offered by an identity provider. The topic is widely studied and many solutions exist. However, logging out of a service using SSO has received less attention. While previous studies note that users want single logout when using SSO, most of the existing services do not offer it, and the identity providers do not even keep track of the open sessions. This article describes challenges related to logout in federated identity management and analyzes unexpected behavior in logout situations. The examples are from the Shibboleth SSO system. Based on the analysis, we give guidelines for implementing reliable logout and describe a polling-based solution for creating a system-wide logout mechanisms that only requires minor changes to the existing code and does not burden the identity provider excessively. In addition to the system-wide logout, our solution gives users the option to log out of only one service. A usability test was conducted to evaluate the solution. The results show that the users liked the ability to choose between the two logout options, but they did not understand the words used to describe them. Another observation was that a majority of the users do not log out of the services at all; they just close the browser window, which should be taken into account in the design of web SSO systems.

Federated identity management: enabling legal control over digital property in the cloud

Timothy S. Reiniger and Dr Richard J. Hansberger review the rapid development of cloud computing services, and issues relating to authenticating identity remotely and the authority and control over proprietary data and information, and whether Federated Identity Management is capable of resolving the problems.

Identity business processes

To facilitate information-system security, e.g., access control or audit, the entities involved play a key role. This makes identity management an important task. The success of service-oriented architectures (SOA) has lead to the development of federated identity management (FIM), to deal with the dynamic nature of SOA and to achieve economies of scale. Business processes in SOA are a composition of services provided by IT systems and manual actions performed by humans. Such compositions highly depend on the identity of participants. The identity in turn determines aspects such as preferred services or assignment of tasks. We analyse how to use FIM technologies to facilitate such identity-based compositions and identify the problems arising from this combination (business processes and FIM). Based on standards for business-process management, access control, and FIM, by carefully considerating design alternatives, we propose a system architecture for the execution of identity-based business processes. The system implements FIM concepts in an application-specific way, based on declarative configuration and taking the run-time context of business processes into account. Finally, we describe our implementation of the architecture based on the ZXID open-source library and its evaluation using a case study.

BwIDM – Federated Access to IT-Based Services at the Universities of the State of Baden-Württemberg

The use and provisioning of services across organizations has not only gained momentum in the business web, but also in academic environments. For instance, in the state of Baden-Wurttemberg, national and state-funded cluster computing resources, operated by a single university, have to be accessible by the users of other universities as well. Two avoid that users have to create and maintain dedicated accounts at each organization, the concept of federated identity management (FIM) can be applied. FIM allows users to use a single identity at their home organization to access services that are operated by other organizations. In this paper, we survey major requirements that need to be considered when establishing such a federation and its technical platform. Furthermore, we show how the bwIDM project established a FIM platform for the state of Baden-Wurttemberg that matches the requirements and that is based on the Security Assertion Markup Language (SAML) standard. In particular, we outline bwIDMs approach on how to integrate non web-based services with SAML federations.

Identity Federations Beyond the Web: A Survey

Internet service providers have, in recent years, adopted identity federation technologies with a high degree of success. A typical Internet user will regularly use these in her daily use of the Internet, even if she does not notice it. For example, she will use these technologies when publishing a picture in Flickr, when sharing it with her friends in her Facebook wall, when she performs a roaming telephone call over the 3G network, or when she obtains access to the eduroam network at her university. Until recently, identity federation technologies were mainly applicable to web and network access services. However, the proliferation of new emerging infrastructures, such as the cloud and grids, is motivating service providers to consider new solutions capable of satisfying identity federation for any almost kind of Internet service (SSH, NFS, SMTP, Cloud, Grid, etc.). This has been called identity federation beyond the Web. International projects and standardization bodies have also been considering ways to satisfy this urgent need. This paper describes the unmet requirement for federating any other kind of (non-Web-based) Internet service. In particular, it provides a detailed survey of the two main proposals, i.e., Application Bridging for Federated Access Beyond Web (ABFAB) and Federated Kerberos (FedKERB), which are currently discussed to provide a solution for this new type of federation, known as Identity Federations beyond the Web. Finally, this paper shows a fair comparison between both alternatives.