Single Sign-on Systems Research Articles

Empowering Users: Towards User-Centric Consent Mechanisms in Single Sign-On Systems

Empowering Users: Towards User-Centric Consent Mechanisms in Single Sign-On Systems

A federated authentication schema among multiple identity providers

Single Sign-On (SSO) methods are the primary solution to authenticate users across multiple web systems. These mechanisms streamline the authentication procedure by avoiding duplicate developments of authentication modules for each application. Besides, these mechanisms also provide convenience to the end-user by keeping the user authenticated when switching between different contexts. To ensure this cross-application authentication, SSO relies on an Identity Provider (IdP), which is commonly set up and managed by each institution that needs to enforce SSO internally. However, the solution is not so straightforward when several institutions need to cooperate in a unique ecosystem. This could be tackled by centralizing the authentication mechanisms in one of the involved entities, a solution raising responsibilities that may be difficult for peers to accept. Moreover, this solution is not appropriate for dynamic groups, where peers may join or leave frequently.In this paper, we propose an architecture that uses a trusted third-party service to authenticate multiple entities, ensuring the isolation of the user's attributes between this service and the institutional SSO systems. This architecture was validated in the EHDEN Portal, which includes web tools and services of this European health project, to establish a Federated Authentication schema.

Empowering Users: Towards User-Centric Consent Mechanisms in Single Sign-On Systems

Empowering Users: Towards User-Centric Consent Mechanisms in Single Sign-On Systems

Influences of displaying permission-related information on web single sign-on login decisions

Web users are increasingly presented with multiple login options, including password-based login and common web single sign-on (SSO) login options such as “Login with Google” and “Login with Facebook”. There has been little focus in previous studies on how users choose from a list of login options and how to better inform users about privacy issues in web SSO systems. In this paper, we conducted a 200-participant study to understand factors that influence participants' login decisions, and how they are affected by displaying permission differences across login options; permissions in SSO result in release of user personal information to third-party web sites through SSO identity providers. We compare and report on login decisions made by participants before and after viewing permission-related information, examine self-reported responses for reasons related to their login decisions, and report on the factors that motivated their choices. We find that usability preferences and inertia (habituation) were among the dominant factors influencing login decisions. After participants viewed permission-related information, many prioritised privacy over other factors, changing their login decisions to more privacy-friendly alternatives. Displaying permission-related information also influenced some participants to make tradeoffs between privacy and usability preferences.

PriSign, A Privacy-Preserving Single Sign-On System for Cloud Environments

Anonymous single sign-on systems allow users to use a single credential to access multiple services protected by verifiers without revealing their personal information, which is especially important due to privacy regulations such as GDPR. In this paper, we introduce a new strong privacy-preserving single sign-on scheme, dubbed PriSign, based on our proposed attribute-based credential with traceability (ABCT), attribute-based credential with blindness (ABCB), and threshold inner-product functional encryption (TIPFE). Compared with the existing state-of-the-art solutions, PriSign presents three improvements: (1) users can obtain different types of tickets according to the attribute disclosure policies enforced by the ticket issuer to support fine-grained access control; (2) users can hide access tokens and designate a verifier for tokens according to a verifier’s policy jointly issued by multiple policymakers, meaning that non-designated verifiers cannot obtain any information about the tokens; (3) we innovatively use a threshold approach to issue policy keys online in order for verifiers to achieve proxy re-verification services in an unstable cloud environment. We implement PriSign and compare the performance with other ASSO systems in the personal laptop, and the results prove its practicability.

Implementasi Single Sign-On Menggunakan Google Identity, REST dan OAuth 2.0 Berbasis Scrum

Single Sign-On (SSO) is a technology that can support user convenience in accessing a system. By using SSO, a user only needs to authenticate once to get access to a system. OAuth 2.0 is one of the protocols that can be implemented on the SSO system. Currently, many Application Service Providers (ASP) support the OAuth 2.0 protocol thus providing convenience in the development of a more standard SSO system. Google Identity is one of the services provided by Google that can be used to build SSO systems using the OAuth 2.0 protocol. Application of the request and response methods provided by the protocol specification OAuth 2.0 and Representational State Transfer (REST) architecture of the system implementation can also make SSO systems more secure. In its implementation, the use of an agile system development methodology with the Scrum framework is used to increase speed and flexibility. The results of this research show that the use of Google Identity, REST, and OAuth 2.0 can provide easy user access, guarantee access validity, accelerate client-server data exchange and simplify the SSO implementation process.

Comparative Analysis and Framework Evaluating Web Single Sign-on Systems

We perform a comprehensive analysis and comparison of 14 web single sign-on (SSO) systems proposed and/or deployed over the past decade, including federated identity and credential/password management schemes. We identify common design properties and use them to develop a taxonomy for SSO schemes, highlighting the associated tradeoffs in benefits (positive attributes) offered. We develop a framework to evaluate the schemes, in which we identify 14 security, usability, deployability, and privacy benefits. We also discuss how differences in priorities between users, service providers, and identity providers impact the design and deployment of SSO schemes.

Moving to a World of More Seamless Single Sign-on Access: NISO’s RA21 Recommended Practice

In this Standards Update column, Todd Carpenter, Executive Director of the National Information Standards Organization (NISO), provides a preview of NISO’s upcoming RA21 Recommended Practice for single sign-on systems. Carpenter describes previous attempts at single sign-on standards, the essential difficulties in authenticating users, and how RA21 will address these issues while ensuring the privacy of user data.

A privacy-enhanced access log management mechanism in SSO systems from nominative signatures

In online services, a service provider (SP) manages access logs containing customers' buying histories. Therefore, user's information is revealed from the exposed logs if each customer can be linked. In fact, such information exposure has occurred due to the popularisation of online services. To cope with this problem, SPs may only have to delete access logs, but then no illegitimate users will be traced from the logs. In this paper, we propose a log management mechanism of solving problems. Specifically, we consider single sign on (SSO) systems, since plural access logs might be connected by one account. We construct our privacy-enhanced access log management mechanism based on the Wang-Wang-Susilo SSO system (TrustCom, 2013) which applies the Schuldt-Hanaoka nominative signature scheme (ACNS, 2011). Finally, we estimte the efficiency of the proposed system, computation time is at most just over 80 milliseconds on a PC, which seems sufficiently practical.

Implementation of a single sign-on system between practice, research and learning systems.

Multiple specialized electronic medical systems are utilized in the health enterprise. Each of these systems has their own user management, authentication and authorization process, which makes it a complex web for navigation and use without a coherent process workflow. Users often have to remember multiple passwords, login/logout between systems that disrupt their clinical workflow. Challenges exist in managing permissions for various cadres of health care providers. This case report describes our experience of implementing a single sign-on system, used between an electronic medical records system and a learning management system at a large academic institution with an informatics department responsible for student education and a medical school affiliated with a hospital system caring for patients and conducting research. At our institution, we use OpenMRS for research registry tracking of interventional radiology patients as well as to provide access to medical records to students studying health informatics. To provide authentication across different users of the system with different permissions, we developed a Central Authentication Service (CAS) module for OpenMRS, released under the Mozilla Public License and deployed it for single sign-on across the academic enterprise. The module has been in implementation since August 2015 to present, and we assessed usability of the registry and education system before and after implementation of the CAS module. 54 students and 3 researchers were interviewed. The module authenticates users with appropriate privileges in the medical records system, providing secure access with minimal disruption to their workflow. No passwords requests were sent and users reported ease of use, with streamlined workflow. The project demonstrates that enterprise-wide single sign-on systems should be used in healthcare to reduce complexity like "password hell", improve usability and user navigation. We plan to extend this to work with other systems used in the health care enterprise.

Logout in single sign-on systems: Problems and solutions

Web single sign-on (SSO) systems enable users to authenticate themselves to multiple online services with one authentication credential and mechanism offered by an identity provider. The topic is widely studied and many solutions exist. However, logging out of a service using SSO has received less attention. While previous studies note that users want single logout when using SSO, most of the existing services do not offer it, and the identity providers do not even keep track of the open sessions. This article describes challenges related to logout in federated identity management and analyzes unexpected behavior in logout situations. The examples are from the Shibboleth SSO system. Based on the analysis, we give guidelines for implementing reliable logout and describe a polling-based solution for creating a system-wide logout mechanisms that only requires minor changes to the existing code and does not burden the identity provider excessively. In addition to the system-wide logout, our solution gives users the option to log out of only one service. A usability test was conducted to evaluate the solution. The results show that the users liked the ability to choose between the two logout options, but they did not understand the words used to describe them. Another observation was that a majority of the users do not log out of the services at all; they just close the browser window, which should be taken into account in the design of web SSO systems.

Modeling Security in Acceptance of Electronic Health Record Systems

Transactional systems are ubiquitous in most industries; however, healthcare organizations continue to slowly diffuse Electronic Health Record (EHR) systems. This research integrates security features such as biometrics for authentication purposes, multiple access connections, and single sign-on systems into the Technology Acceptance Model to explore whether these features might improve user acceptance of EHR. Security potentially affects user perceptions of ease of use and usefulness, improving acceptance of EHR systems. This work contributes to the literature by exploring whether security features are important in shaping health care worker attitudes towards EHR systems.

Exploring how security features affect the use of electronic health records

While individuals in most organisations routinely use computers to conduct business, few healthcare organisations have Electronic Health Record Systems (EHRS). Healthcare organisations face many obstacles and challenges when implementing EHRS including healthcare staff and physician resistance, security issues, and costs. While previous studies explored physician and healthcare organisation adoption issues, this study uses Smart PLS to explores why staff members resist EHR usage using a hybrid Technology Acceptance Model (TAM). It examines whether security measures including biometrics for authentication purposes, multiple access features provided to healthcare provider, and use of Single Sign-On (SSO) systems influences these individual's attitude toward EHRS.

A user-centric federated single sign-on system

Current identity management systems are not concerned with user privacy. Users must assume that identity providers and service providers will ensure their privacy, which is not always the case. This paper proposes an extension of the existing federated single sign-on (FSSO) systems that adopts the beneficial properties of the user-centric identity management (UCIM) model. This new identity management system allows the users to control and enforce their privacy requirements while still retaining the convenience of single sign-on over a federation of service providers. Colored Petri Nets are used to formally model the new identity management system to provide assurance that the privacy goals are achieved. To our knowledge, Colored Petri Nets have not been used to model privacy in identity management systems before.

Open Source in Web-Based Applications

Business and recreational activities on the global communication infrastructure are increasingly based on the use of remote resources and services, and on the interaction between different, remotely located parties. In such a context, Single Sign-On technologies simplify the log-on process allowing automatic access to secondary domains through a unique log-on operation to the primary domain. In this article, we evaluate different Single Sign-On implementations focusing on the central role of Open Source in the development of Web-based systems. We outline requirements for Single Sign-On systems and evaluate four existing Open Source implementations in terms of degree of fulfilment of those requirements. Finally we compare those Open Source systems with respect to some specific Open Source community patterns.