Single Sign-on Mechanism Research Articles

The Preliminary Investigation of SSO Protocol for the Suitability of Mission Critical Applications

Objective: Single Sign-On (SSO) mechanism mitigates the complexity by providing a single set of login credentials for disparate systems. The main objective of SSO in mission critical applications is to provide a most trusted authentication provider while ensuring the secured online service. Methods: Exploiting third party identity provider leads Open ID connect to not fit in banking services. Since traditional banking systems refuse to disclose the user-sensitive information to any third party, the conventional models lack in maintaining the consistent revocation model. However, the maintenance of user details at server needs to follow the consistent revocation model at all connected banks. The conventional SSO protocols follow different ways to develop the access control policies to recognize the user identity. However, the banking services need role-based access control policy. Findings: In order to provide the secure SSO to banking services, this work presents the extended Open ID connect protocol with additional security features which are more suitable to the online banking systems. The extended Open ID connect provides the role of identity provider to RBI which is a centralized authority to connect all the banks and their user accounts. It exploits the chaotic sequence encryption algorithm to dynamically manage the session, which facilitates the common revocation model. This restricts the impersonation, modification, and eavesdropping attacks while accessing the online banking services with SSO mechanism. The request identification and validation using random user ID in every subsequent page access ensures the security of the online transaction. Moreover, the request identification and validation using random user ID in every subsequent page access ensures the security of the online transaction. Application/Improvements: The proposed model tightens the security of Open ID connect with the support of Chaotic sequence encryption, common revocation model, and request identification. It successfully extends the usage of SSO to mission critical applications. Keywords: Banking Service, Chaotic Sequence Encryption, Open ID connect, Revocation, Identity Provider

Kombinasi Waktu Sinkronisasi dan Nilai Salt untuk Peningkatan Keamanan pada Single Sign-On

Single sign-on (SSO) is a session authentication process that allows a user to login by using user registered identity and password in order to access appropriate applications. The authentication process takes the user in to login for all the applications they have been given rights to and eliminates further prompts when they switch applications during a particular session. Its implementation will provide a reduction of password burden to access many applications for every login process. Ease of access through a single account needs to be addressed carefully to ensure the authentication credentials that are not scattered and known by others. Currently, there are several open source SSO authentication methods available. However, the use of existing authentication methods is still vulnerable to attack, such as Man-In-The-Middle. In this study, SSO authentication algorithm using One-Time Password (OTP) is proposed using a combination of time synchronization and salt value. These combinations are used to verify user session while accessing any application with SSO mechanism. The results show that the proposed OTP algorithm can handle SSO authentication process in good fashion and also protect from Man-In-The-Middle Attack.

LiftingDoneRight

This article describes the design and implementation of LiftingDoneRight, a novel system for healthcare professionals to enhance their compliance with best practices and regulations regarding proper body mechanics for lifting and pulling activities. The system uses Microsoft Kinect to track the motion of consented users non-intrusively. The system relies on the use of a smartwatch to deliver an alert via vibration and text display whenever a wrong activity that violated the proper body mechanics has been detected. A core contribution of this study is a registration mechanism for a healthcare professional to explicitly give permission to the system to monitor his or her activities. Furthermore, a non-intrusive biometrics-based single sign-on mechanism is incorporated into the system to allow a user to be automatically identified for tracking as long as the user has manually registered with the system before. Finally, the system offers a number of configurations to accommodate different usability needs and privacy requirements.

A SECURE SYSTEM IN DISTRIBUTED COMPUTER NETWORKS USING SINGLE SIGN-ON MECHANISM

nIn the distributed computer network environment, it is easy for user terminals to share information and computing power with hosts. Accessing of resources becomes efficient and convenient because of the distributed locations of service providers. A Single Sign-On is a method of access control that enables a user to log in once and gain access to the resources of multiple software systems without being prompted to log in again. This scheme is based on one-way hash functions and randomly used to decrease the overhead of the system. In this Paper a secure system with single sign-on mechanism is proposed which allow mobile users to use the unitary token to access service providers.

ADVANCED MECHANISM FOR SINGLE SIGN-ON FOR DISTRIBUTED COMPUTER NETWORKS

A distributed computer networks could be a special form of the network that facilitates the purchasers to use completely different network services that is provided by the service suppliers. Within the distributed computer networks, user verification is a crucial method for the protection. Within the verification, the choice is taken whether the user is legal or not and then enabled the users to access the service. In general users are using multiple usernames and passwords for to access different applications on a distributed computer network. This increase the burden of the user and organization administrator as each and every account of the organization is going to be handled with their explicit username and credential. A new certification plan that is named as single sign-on mechanism that facilitates the users with one identity token to be verified by multiple service suppliers. Single signon is one of user authentication method that allows a user to enter one name and identity token so as to access multiple applications. The method authenticates the user for all the applications they have been offered access to and eliminates additional prompts after they switch applications throughout a specific session. However, existing approaches which are utilizing single sign-on scheme have some drawbacks relating to security needs. Thus, through this paper, we will discuss regarding the event of security from earlier stage to present stage. And clearly discuss regarding the authentication steps between user and service supplier.

Accessing securely a corporate eHealth community through social media identities

Authentication in companies is a recurring problem. This problem is even more crucial in the medical world where, on the one hand, we have medical confidentiality and, on the other hand, we need fast access to the patient’s records. As social media progressively infiltrate human activity, they could be a solution to this dual problem. We have developed a JAVA web application which, based on the authentication and the security inherent in these networks, allows users to authenticate themselves through media such as Facebook and Google or resorting to a key like the SuisseID. The Single Sign-On principle and the SAML standard are the drivers of the resulting authentication. Single Sign-On solves the problem of forgetting/losing multiple passwords, promoting fast and easy connection. Our application is able to authenticate a user by means of their username and password derived either from the main account of the application or from their attributes on an external account such as Facebook, previously coupled to their main account. The application can directly create an account on the basis of an external «social» account. The pairing between the social account and an account internal to our application enables the Single Sign-On mechanism which, in the medical world, will accelerate the access to patient records. Our application provides strong authentication as well as a Single Sign-On property. Its design is open to various new identity providers. An interesting future perspective.

Single Sign-On in Cloud Federation using CloudSim

Single Sign-On (SSO) is an authentication mechanism in which a Cloud Service Consumer (CSC) needs to be authenticated only once while accessing various services from multiple service providers, or when accessing multiple services from the same service provider. In the case of Cloud Federation, the consumers can get services from various Cloud Service Providers (CSPs) who are members of the federation, and SSO can be used to verify the legitimate users without requiring them to get authenticated with each service provider separately. CloudSim is a popular tool used for simulating various cloud computing scenarios. As of now, the simulator lacks effective user authentication and authorization methods with it. In this paper, we discuss the design and implementation of SSO mechanism in the Cloud Federation scenario using the CloudSim toolkit. We have used the Fully Hashed Menezes-Qu-Vanstone (FHMQV) protocol for the key exchange and the Symmetric Key Encryption technique AES-128 for encrypting the identity tokens. We give the workflow model for the proposed approach of SSO in the Cloud Federation and also, the execution time taken in the simulation for various Single Sign-On scenarios where the number of SSO required varies are also shown.

Design of Authentication Model Preserving Intimacy and Trust in Intelligent Environments

With the recent advances in communication technologies for low-power devices, pervasive computing environments (PCE) spread as new domains beyond legacy enterprise and personal computing. The intelligent home network environment is thing which invisible device that is not shown linked mutually through network so that user may use device always is been pervasive. Smart devices are interconnected and collaborate as a global distributed system to infuse intelligence into systems and processes. This kind of environment provides various smart services and makes consequently an offer of convenient, pleasant, and blessed lives to people. However, the risk is high as long as the offer is pleasant and convenient. In such context, security is stil very fragile and there is often a violation of user privacy and service interference. For this, a special interest in ubiquitous network security is going up. Safety lies primarily in the authentication of users accessing the network. It guarantees that only legitimate users can login and access to services indoor the network. In this paper, we propose an anonymous authentication and access control scheme to secure the interaction between mobile users handling smart devices and smart services in PCEs. In an environment based on public key infrastructure (PKI) and Authentication, Authorization, and Accounting (AAA), the proposed authentication protocol combines both network authentication technique based on symmetric keys and single sign-on mechanisms. The authentication protocol is simple and secure, protects the privacy of user and aims to satisfy the security requirements.

Single Sign-on Mechanism for Secure Web Service Access through ISSO

Single sign-on (SSO) is an emerging and more secure authentication mechanism that enables an authorized user with a single username/password to be authenticated by many service providers in a distributed network system. The existing technique used SSO scheme and it has achieved security by applying well-organized security parameters and its improved scheme introduced Verifiable Encryption of Signatures (RSA-VES). But the improvement of both the techniques with respect to security is not fully accomplished. We identified two attacks in existing SSO techniques. The first attack permits a malicious service provider to successfully communicate with a legal user more than one time and to recover the authenticated username/password and then to impersonate the service consumer to grant access to web resources and web services provided by other SP (Service Provider). Another attack is that a third party without any security credential may be able to access network services easily by impersonating some legal user or a fictional user. In our proposed work we introduced Improved Single sign-on (ISSO) scheme, which prevents Credential recovery attack, Impersonation attack and Data injection attack. We used the modified version of JMeter open source tool for generating the test report of the particular web apps. We implemented three web applications which provide financial solutions to customers. These three web applications used SOAP based request and response mapping for efficient handling of communication protocols. The testing result stated that the ISSO scheme fights against the attacks that were present in current SSO scheme.

A Quantum Single Sign-On Protocol Based on GHZ States

Single Sign-On (SSO) is an important cryptography mechanism in distributed systems. Quantum cryptography has gained great successes and makes great influence on traditional cryptography. In this paper, we combines the SSO mechanism and quantum cryptography together. A SSO protocol based on GHZ states is designed. Through security analysis, we show that this protocol has good security properties.

Beyond xMOOCs in healthcare education: study of the feasibility in integrating virtual patient systems and MOOC platforms.

Background. Massive Open Online Courses (MOOCs) are an emerging trend in online learning. However, their technology is not yet completely adjusted to the needs of healthcare education. Integration of Virtual Patients within MOOCs to increase interactivity and foster clinical reasoning skills training, has been discussed in the past, but not verified by a practical implementation.Objective. To investigate the technical feasibility of integrating MOOCs with Virtual Patients for the purpose of enabling further research into the potential pedagogical benefits of this approach.Methods. We selected OpenEdx and Open Labyrinth as representative constituents of a MOOC platform and Virtual Patient system integration. Based upon our prior experience we selected the most fundamental technical requirement to address. Grounded in the available literature we identified an e-learning standard to guide the integration. We attempted to demonstrate the feasibility of the integration by designing a “proof-of-concept” prototype. The resulting pilot implementation was subject of verification by two test cases.Results. A Single Sign-On mechanism connecting Open Labyrinth with OpenEdx and based on the IMS LTI standard was successfully implemented and verified.Conclusion. We investigated the technical perspective of integrating Virtual Patients with MOOCs. By addressing this crucial technical requirement we set a base for future research on the educational benefits of using virtual patients in MOOCs. This provides new opportunities for integrating specialized software in healthcare education at massive scale.

English

English

A Non-entanglement Quantum Single Sign-On Solution

Single Sign-On (SSO) is an important cryptography mechanism in distributed systems and is implemented by many known distributed systems, such as the famous Kerberos. Quantum cryptography has gained great successes and makes great influence on traditional cryptography. In this paper, we combines the SSO mechanism and quantum cryptography together. A SSO solution under almost pure quantum cryptography is designed. Through security analysis, we show that this solution has good security properties.

Single Sign-On Under Quantum Cryptography

Single Sign-On (SSO) is an important cryptography mechanism in distributed systems and is implemented in many known systems, such as the famous Kerberos. Quantum cryptography has excellent security properties guaranteed by physical principles and makes great influence on traditional cryptography. In this paper, we combines the SSO mechanism and quantum cryptography together. A SSO solution under quantum cryptography is designed. Through security analysis, we show that this solution has good security properties.

Security Analysis of a Single Sign-On Mechanism for Distributed Computer Networks

Single sign-on (SSO) is a new authentication mechanism that enables a legal user with a single credential to be authenticated by multiple service providers in a distributed computer network. Recently, Chang and Lee proposed a new SSO scheme and claimed its security by providing well-organized security arguments. In this paper, however, we demonstrative that their scheme is actually insecure as it fails to meet credential privacy and soundness of authentication. Specifically, we present two impersonation attacks. The first attack allows a malicious service provider, who has successfully communicated with a legal user twice, to recover the user's credential and then to impersonate the user to access resources and services offered by other service providers. In another attack, an outsider without any credential may be able to enjoy network services freely by impersonating any legal user or a nonexistent user. We identify the flaws in their security arguments to explain why attacks are possible against their SSO scheme. Our attacks also apply to another SSO scheme proposed by Hsu and Chuang, which inspired the design of the Chang–Lee scheme. Moreover, by employing an efficient verifiable encryption of RSA signatures proposed by Ateniese, we propose an improvement for repairing the Chang–Lee scheme. We promote the formal study of the soundness of authentication as one open problem.

Analysis of privacy vulnerabilities in single sign-on mechanisms for multimedia websites

This paper studies the privacy risks for the users of two popular single sign-on platforms for web-based content access: OpenID and Facebook Connect. In particular we describe in detail a privacy vulnerability of the OpenID Authentication Protocol that leads to the exposure of the OpenID user identifier to third parties. We illustrate how OpenID agents leak the (potentially unique) OpenID identifiers of their users to third parties, like advertisement and traffic analysis corporations. This vulnerability is a real and widespread privacy risk for OpenID users. This paper also analyzes the privacy of Facebook Connect --the proprietary single sign-on platform that is gaining a lot of popularity recently-- and, we conclude that it is not affected by the same vulnerability but other important privacy issues remain. Finally, this paper studies the solution space of these problems and defines a number of possible countermeasures. In the case of the OpenID vulnerability, we propose three solutions to this problem: one for the long term to avoid the root cause of the vulnerability, and another two short-term mitigations.

A Secure Single Sign-On Mechanism for Distributed Computer Networks

User identification is an important access control mechanism for client-server networking architectures. The concept of single sign-on can allow legal users to use the unitary token to access different service providers in distributed computer networks. Recently, some user identification schemes have been proposed for distributed computer networks. Unfortunately, most existing schemes cannot preserve user anonymity when possible attacks occur. Also, the additional time-synchronized mechanisms they use may cause extensive overhead costs. To overcome these drawbacks, we propose a secure single sign-on mechanism that is efficient, secure, and suitable for mobile devices in distributed computer networks.

Enabling remote access to projects in a large collaborative environment

In the context of the Integrated Tokamak Modelling Task Force, a large number of software projects are made available to the task force members, including developers and end-users. This has been achieved through a combination of tools and technologies. The front-end is represented by a Java based portal system exposing a PHP project management system, GForge. These two applications are linked by a single sign-on mechanism, Shibboleth [1], and through secure HTTP [2] request rewriting, where appropriate. Furthermore, the underlying storage facility is an OpenAFS [3] distributed file system and the user base comes from both a network information server and an LDAP [4] directory. Security mechanisms are those of a distributed system, with multiple access points and protocols used for reading and writing data. The present paper presents the challenges of integrating these different technologies and programming languages into a single, working, application presented to its users as a web portal. Chaining of the tools is explored through the user perspective, with an in-depth overview of the background transitions between the various systems involved with regard to security requirements for the front-end nodes and the policies as seen by the users.

Performance analysis of a cross-layer SSO mechanism for a roaming infrastructure

Over the last decade, several international initiatives have tried to provide different solutions to a common issue: resource sharing among several institutions. Some have been mainly designed for Web resources or computing resources, like Grid Computing environments, or even for network access for roaming users. A common aspect in most of those approaches is the management of identities, that is, the representation of the information related to specific individuals or other entities and its use for authentication and authorization purposes. However, since the different solutions are focused on different application scenarios (Web, Grid, and network) it has been really difficult to create a unified point of view (cross-layer) for identity management and, therefore, mechanisms like Single Sign On (SSO) across different layers are considered to be a main gap in current efforts. In this article, we present an architecture based on an existing solution for roaming in educational environments (eduroam). The architecture is able to provide what has been called a unified SSO mechanism, that is, once the users have been authenticated during the network access, they are enabled to obtain protected resources at higher layers (like Web resources) without further re-authentication. Additionally, we include a performance analysis to illustrate the feasibility of this architecture, which has been tested in a real production environment like eduroam.

Identity management systems

Most organizations have difficulty keeping track of and controlling all the user identifiers and passwords across their systems. Identity management (IdM) systems are designed to help manage user identifiers across multiple systems as well as providing a way to manage user access over their lifecycle of roles in the organization. They are tightly integrated with other systems such as those that provide a single sign-on mechanism and the checking of their credentials. As such, these IdM systems have become extremely common in information technology infrastructure.