Single Sign-on Research Articles

Analysis of factors that influence satisfaction and usefulness for attendance system with the Delone & McLean model (case study: attendance system at Diponegoro University)

The attendance system is an educational management tool at Diponegoro University used for attendance activities using technology. The attendance system is implemented in the “Sistem Informasi Akademik, Penelitian dan Pengabdian” (SIAP) application and can be accessed by students through Single Sign On (SSO). Students can do it using the smartphone they have. This research is analyzed through the factors that affect students’ satisfaction and usefulness after using the attendance system. The analysis will be performed using the Delone & McLean model and additional usefulness variables from the Technology Acceptance Model (TAM) model. A total of 506 respondents participated in this research. Respondent data is then processed using smartPLS 3.0 software. Based on the research, some indicators do not meet the measurement criteria. The attendance information on the attendance system can be accessed using various types of smartphones, so the indicators must be removed from the model. The research results have found that system quality affects usefulness, service quality effect on usefulness, information quality effect on usefulness, system quality effect user satisfaction, service quality effect on user satisfaction, information quality affect on user satisfaction, and usefulness effect on user satisfaction.

Challenges in Single Sign-On

Single sign-on uses a centralized session concept, and it is a service that authenticates one and one-on-one designated platform. Later, with this, we can use various services and products without logging in every time. However, there are sure demanding situations in implementing SSO. Business enterprise no longer is most effective and needs to integrate user network logon with a nearby application and software program (SaaS) cloud offering. Simultaneously, in an enterprise, SSO’s centralized solution does not include all the users, applications, devices, and equipment. Another undertaking from the records angle is that the user can log on outside SSO answers. Its user identification may also exist in exceptional forms. Simultaneously, the enterprise desires to cope with bequest desktop programs that do not coordinate with users’ listing logins which may be the frail hyperlink that reasons SSO to fail in the company. With the efficiently applied SSO and designing framework keeping in mind the challenges, we can enable and disable users to enter more than one system, platform, apps, and different resources. Also, it may effectively resolve and dispose of the problem of password-related downtime and reset expenses. Simultaneously, it removes the danger of threat from an insider, improves authentication processes and user experience, delivers authority to the company, and simultaneously provides them with the right of entry to firmly on top of the user’s things.

Implementasi Penetration Testing Execution Standard Untuk Uji Penetrasi Pada Layanan Single Sign-On

Increasing the use of single sign-on technology by electronic-based service providers in addition to providing benefits also creates vulnerability. Penetration testing needed to identify vulnerabilities and test system security by exploiting those vulnerabilities. This research implements the Penetration Testing Execution Standard (PTES) for penetration testing of single singn-on services. Seven stages of the penetration test had done and 12 vulnerabilities were identified, consisting of 3 medium vulnerabilities, 6 low vulnerabilities and 3 information vulnerabilities. Six cyberattacks have been carried out to exploit the vulnerability with the result of 3 successful attacks and 3 failed attacks. Based on the results of the vulnerability and exploitation analysis, recommendations are given consist of regular updating and patching efforts, configuration of the CSP header and content-type-option header on the web server and application server, validation of the host header configuration, x-content-type-options header and deactivation. x-forwarded- hosted on every web page, configure 'secure' flag on cookies, add metacharacter filter feature in source code, and limit login attempts. The results of the PTES’s implementation are proven to make it easier for testers to carry out penetration tests and effectively prevent disputes between testers and clients due to differences in the scope of testing.

Off-campus Access to Licensed Online Resources through Shibboleth

Institutions of advanced education and research, through their libraries, invest substantially in licensed online resources. Only authorized users of an institution are entitled to access licensed online resources. Seamless on-campus access to licensed resources happens mostly through Internet Protocol (IP) address authentication. Increasingly, licensed online resources are accessed by authorized users from off-campus locations as well. Libraries will, therefore, need to ensure seamless off-campus access to authorized users. Libraries have been using various technologies, including proxy server or virtual private network (VPN) server or single sign-on, to facilitate seamless off-campus access to licensed resources. In this paper, authors share their experience in setting up a Shibboleth-based single sign-on (SSO) access management system at the JRD Tata Memorial Library, Indian Institute of Science, to enable authorized users of the institute to seamlessly access licensed online resources from off-campus locations.

Data Spine: A Federated Interoperability Enabler for Heterogeneous IoT Platform Ecosystems.

Today, the Internet of Things (IoT) is pervasive and characterized by the rapid growth of IoT platforms across different application domains, enabling a variety of business models and revenue streams. This opens new opportunities for companies to extend their collaborative networks and develop innovative cross-platform and cross-domain applications. However, the heterogeneity of today’s platforms is a major roadblock for mass creation of IoT platform ecosystems, pointing at the current absence of technology enablers for an easy and innovative composition of tools/services from the existing platforms. In this paper, we present the Data Spine, a federated platform enabler that bridges IoT interoperability gaps and enables the creation of an ecosystem of heterogeneous IoT platforms in the manufacturing domain. The Data Spine allows the ecosystem to be extensible to meet the need for incorporating new tools/services and platforms. We present a reference implementation of the Data Spine and a quantitative evaluation to demonstrate adequate performance of the system. The evaluation suggests that the Data Spine provides a multitude of advantages (single sign-on, provision of a low-code development environment to support interoperability and an easy and intuitive creation of cross-platform applications, etc.) over the traditional approach of users joining multiple platforms separately.

Success and Failure Aspects of LMS in E-Learning Systems

<p>Learning management systems (LMS) and their associated<br />tools have created value for higher education institutions worldwide<br />by improving content deliverability, accessibility, and retrievability.<br />Nevertheless, many studies have criticised these systems for their<br />teacher-centred approaches, which limit opportunities for social and informal<br />learning. After several decades of institutions using LMS, this research<br />aims to discuss the success and failure aspects of these LMS from<br />various perspectives, including structure, content, and support for emerging<br />technologies. Based on a thematic literature review and analysis, success<br />and failure aspects are organised and verified by LMS experts.<br />Alongside the aspects identified from the literature, these experts also<br />noted several additional aspects of success and failure in LMS. The analysis<br />results overall indicated the success aspects of LMS relate to seven<br />key factors: single sign-on, learning management, content management,<br />integration, security, tracking, and group management. Similarly, the<br />failure aspects could be classified into eight factors: content creation and<br />sharing, communicative features, structure, learning engagement, assessment,<br />user interfaces, social and informal learning, and mobile features.<br />The implications of the research for education institutions, instructors,<br />developers, and system providers, as well as the resulting directions for<br />future research, are thus also discussed to help increasing the chances of<br />developing additional theoretical and practical insights.</p>

Implementation of google single sign On (SSO) in the library management system

Almost all organizations provide web-based services as an effort to provide excellent services to users, such as a library, academic, financial, and other services. Organizations only need to provide Single Sign-on (SSO) services for their users, and users need one set of credentials (user name and password) to access all organizational services. The SSO service developed is based on the Google Authentication API. This SSO makes communication between systems more effective and efficient.

Usability Testing for Student Academic Information System in State Polytechnic of Creative Media

SIAM (Student Academic Information System) is an academic services information system that has been implemented at the State Polytechnic of Creative Media (Polimedia). It’s been two months SIAM has been integrated using Single Sign On (SSO). After we implemented SIAM new version we received a lot of complaints every day. In this research, the authors conducted a usability test on the SIAM new version in order to determine the effectiveness and performance of the application. Usability test components include effectiveness, efficiency, and satisfaction. The average usability 70% indicates that the SIAM new version has a good usability performance.

Lightweight Technical Implementation of Single Sign-On Authentication and Key Agreement Mechanism for Multiserver Architecture-Based Systems

Authentication is the primary and mandatory process for any Information and Communication Technology (ICT) application to prove the legitimacy of the genuine user. It becomes more important and crucial for public platforms like e-governance platforms. The Government of India is transforming the country into Digital India through various e-governance initiatives based on ICT. For authentication, National e-Authentication Framework (NeAF) was proposed by the Indian government which is a policy framework for authentication. This framework does not provide any technical and unified solution for authentication systems while it is based on centralized verification data. In this paper, we proposed a solution for the authentication which provides the unified authentication solution for the Indian e-governance system with existing infrastructure. This solution also provides the features such as scalability, security, and transparency based on distributed computing and working on multiserver architecture. This solution also fulfills the need of the current Indian government to provide multiple e-governance services through a single smart card.

Perceptions of event notification following discharge to improve geriatric care: qualitative interviews of care team members from a 2-site cluster randomized trial

To assess primary care teams' perceptions of a health information exchange (HIE) event notification intervention for geriatric patients in 2 Veterans Health Administration (VHA) medical centers. We conducted a qualitative evaluation of an event notification alerting primary care teams to non-VHA hospital admissions and emergency department visits. Data were collected through semistructured interviews (n = 23) of primary care team physicians, nurses and medical assistants. Study design and analysis were guided by the Consolidated Framework for Implementation Research (CFIR). Team members found the alerts necessary, helpful for filling information gaps, and effective in supporting timely follow-up care, although some expressed concern over scheduling capacity and distinguishing alerts from other VHA notices. Participants also suggested improvements including additional data on patients' diagnosis and discharge instructions, timing alerts to patients' discharge (including clear next steps), including additional team members to ensure alerts were acted upon, and implementing a single sign-on. Primary care team members perceived timely event notification of non-VHA emergency department visits and hospital admissions as potentially improving post-discharge follow-up and patient outcomes. However, they were sometimes unsure of next steps and suggested the alerts and platform could be streamlined for easier use. Event notifications may be a valuable tool in coordinating care for high-risk older patients. Future intervention research should explore the optimal amount and types of information and delivery method across sites and test the integration of alerts into broader care coordination efforts.

A Smartcard-Based User-Controlled Single Sign-On for Privacy Preservation in 5G-IoT Telemedicine Systems.

Healthcare is now an important part of daily life because of rising consciousness of health management. Medical professionals can know users’ health condition if they are able to access information immediately. Telemedicine systems, which provides long distance medical communication and services, is a multi-functional remote medical service that can help patients in bed in long-distance communication environments. As telemedicine systems work in public networks, privacy preservation issue of sensitive and private transmitted information is important. One of the means of proving a user’s identity are user-controlled single sign-on (UCSSO) authentication scheme, which can establish a secure communication channel using authenticated session keys between the users and servers of telemedicine systems, without threats of eavesdropping, impersonation, etc., and allow patients access to multiple telemedicine services with a pair of identity and password. In this paper, we proposed a smartcard-based user-controlled single sign-on (SC-UCSSO) for telemedicine systems that not only remains above merits but achieves privacy preservation and enhances security and performance compared to previous schemes that were proved with BAN logic and automated validation of internet security protocols and applications (AVISPA).

AAAA: SSO and MFA Implementation in Multi-Cloud to Mitigate Rising Threats and Concerns Related to User Metadata

In the modern digital era, everyone is partially or fully integrated with cloud computing to access numerous cloud models, services, and applications. Multi-cloud is a blend of a well-known cloud model under a single umbrella to accomplish all the distinct nature and realm requirements under one service level agreement (SLA). In current era of cloud paradigm as the flood of services, applications, and data access rise over the Internet, the lack of confidentiality of the end user’s credentials is rising to an alarming level. Users typically need to authenticate multiple times to get authority and access the desired services or applications. In this research, we have proposed a completely secure scheme to mitigate multiple authentications usually required from a particular user. In the proposed model, a federated trust is created between two different domains: consumer and provider. All traffic coming towards the service provider is further divided into three phases based on the concerned user’s data risks. Single sign-on (SSO) and multifactor authentication (MFA) are deployed to get authentication, authorization, accountability, and availability (AAAA) to ensure the security and confidentiality of the end user’s credentials. The proposed solution exploits the finding that MFA achieves a better AAAA pattern as compared to SSO.

Implementation of Rivest Cypher 4 algorithm in Security Assertion Mark-up Language protocols on Single Sign-On services

Single Sign-On (SSO) is an authentication service that allows users to use a set of credential data to access multiple applications. The SSO can be implemented using Security Assertion Mark-up Language (SAML) which is recognized as a framework or standard for sending open messages that allow identity and security information to be shared to each entity. Credential data sent over the network enable unauthorized users to capture the data and this will be fatal since the data can be used to access all applications in the SSO entity. This study aims to propose a credible data security approach that is reliable so that the data is not easily read by unauthorized users even with the dictionary attacks. This security method is performed using the Rivest Cypher 4 (RC4) algorithm. This study is resulting in two major phenomena, (1) the utilization of the RC4 algorithm on SAML in SSO services has proven to be an effective data security approach for dictionary attacks, (2) the formulation of the RC4 algorithm on SAML has proven to not interfere with SSO services in the user authentication process.

Comparison of Security Signing Data Authentication Integrity in Combination of Digest And AES Message Algorithm

Online information systems with the Single Sign-On (SSO) model are currently widely used by many companies. Single Sign-On (SSO) is an independent authentication model. This system runs on the Hypertext Transfer Protocol (HTTP) protocol. Sending data or information without security is at risk of eavesdropping on information by the authorities. This study aims to compare the combination of Message-Digest and Advanced Encryption Standard (AES) algorithms to improve data security by modifying dynamic keys. The test results show that in each execution the user name and password with the MD5 algorithm are always the same while in the AES algorithm the results are always different so it is safe from replay attacks. So that the Advanced Encryption Standard (AES) algorithm can secure data through the Single-Sign-On authentication process with high-security accuracy.

Blockchain based Privacy Preserving User Authentication Protocol for Distributed Mobile Cloud Environment

The development in cloud computing platforms has resulted, hosting many day-to-day service applications in the cloud. To avail the services provided by different cloud service providers (CSPs), the mobile user has to register his/her identity with the CSPs. The mobile user (MU) has to remember multiple identities and credentials to access various CSPs. Many single sign-on schemes have been proposed in the literature to eliminate multiple registrations by mobile users to access CSPs. Most of these schemes rely on a trusted third party known as Registration Authority Center (RAC), which is a centralized entity to manage the identity information of all the mobile users registered with it. The centralized RAC has two operational problems, i.e., RAC has full control over the data it possesses, resulting in the possibility of the data breach and increased risk of single-point-of-failure. In this paper, we propose a blockchain based privacy preserving user authentication protocol for distributed mobile cloud environment, which solves these two traditional problems with centralized registration centers. In proposed protocol, the registration of MU and CSP are performed through public blockchain network for MU to access CSPs and the authentication was performed between MU and CSP through public blockchain. The public blockchain network stores MU and CSPs identity information. Public blockchain network provides integrity to the data stored in it and secures the system from single-point-of-failure. In addition, security analysis and performance analysis were also performed for proposed protocol and it showed that the proposed protocol is secure from all-known attacks with better performance efficiency.

EL PASSO: Efficient and Lightweight Privacy-preserving Single Sign On

Abstract Anonymous credentials are a solid foundation for privacy-preserving Single Sign-On (SSO). They enable unlinkable authentication across domains and allow users to prove their identity without revealing more than necessary. Unfortunately, anonymous credentials schemes remain difficult to use and complex to deploy. They require installation and use of complex software at the user side, suffer from poor performance, and do not support security features that are now common, such as two-factor authentication, secret recovery, or support for multiple devices. In contrast, Open ID Connect (OIDC), the de facto standard for SSO is widely deployed and used despite its lack of concern for users’ privacy. We present EL PASSO, a privacy-preserving SSO system based on anonymous credentials that does not trade security for usability, and can be incrementally deployed at scale alongside Open ID Connect with no significant changes to end-user operations. EL PASSO client-side operations leverage a WebAssembly module that can be downloaded on the fly and cached by users’ browsers, requiring no prior software installation or specific hardware. We develop automated procedures for managing cryptographic material, supporting multi-device support, secret recovery, and privacy-preserving two-factor authentication using only the built-in features of common Web browsers. Our implementation using PS Signatures achieves 39x to 180x lower computational cost than previous anonymous credentials schemes, similar or lower sign-on latency than Open ID Connect and is amenable for use on mobile devices.

Fingerprint Based Authentication Architecture for Accessing Multiple Cloud Computing Services using Single User Credential in IOT Environments

Cloud computing technology provides access to the pool of configurable resources including storage space, application, services and on demand network. Involvement of Cloud with the organization minimizes organization efforts toward fulfilling its customer’s needs. One of the major advantages of cloud computing is the Single Sign On (SSO) technique that allows the user to access multiple application services using a single user credential. In cloud computing, there are many issues, and challenges to be discussed. However, prevention from security attacks is much more difficult in preserving privacy of user agents. This paper has proposed SSO-based bio-metric authentication architecture for cloud computing services to overcome the security and privacy attacks. Bio-metric authentication is effective for resources controlled by end devices at the time of accessing the cloud services since these devices are computationally inefficient for user information processing during authentication. Accordingly, security attack in the cloud computing gets minimized using the proposed architecture. The proposed architecture also includes a novel approach in which there exist one to one relationship between user agent and the service provider. In this user agents can use their fingerprint while requesting for registration and accessing different cloud application services at cloud. Based on comparative study with several existing architectures, the highlights of the proposed architecture have been presented.

UIP2SOP: A Unique IoT Network applying Single Sign-On and Message Queue Protocol

Internet of Things (IoT), currently, plays an importance role in our life, also, this is one of the most rapidly developing technology trends. However, the present structure has some limitation - one of these is the communication via client-server model - the users, devices, and applications using IoT services where all the connection/requirement is managed at IoT service providers. On the one hand, the IoT service providers (e.g., individual, organization) have different method to manage their devices, services, and users. Thus, the unique standard (i.e., communication method among the service providers and between client server) is still the challenge for the developers. On the other hand, Message Queuing Telemetry Protocol (MQTT) that is one of the most popular protocols in IoT deployments, has signif-icant security and privacy issues by itself (e.g., authentication, authorization, as well as privacy problem). Therefore, this paper proposes UIP2SOP - an unique IoT network by using Single Sign-On (SSO) and message queue to improve the MQTT protocol’s security problem. Besides, this model allows the organizations to provide the IoT services to connect into a single network but does not change the architecture of organization at all. The evaluation section proves the effectiveness of our proposed model. In particular, we consider the number of concurrent users publishing messages simultaneously in the two scenarios i) internal communication and ii) external communication. In addition, we evaluate recovery ability of system when occurred broken connection. Finally, to engage further reproducibility and improvement, we share a complete code solution is publicized on the GitHub repository.

Centralized Control of Account Migration at Single Sign-On in Shibboleth

Centralized Control of Account Migration at Single Sign-On in Shibboleth

An Anonymous Key Distribution Scheme for Group Healthcare Services in 5G-Enabled Multi-Server Environments

Fifth generation (5G) mobile technology enables a new kind of network that provides high peak data rates, ultra-low latency communication and high user density. Electronic healthcare (e-health) allows the data to be stored and shared in a highly efficient and flexible manner. Group e-health services help in improving long-term results of the treatments due to its collaborative characteristic. The services including real-time remote patient monitoring and transmission of large health data files can be facilitated by e-health systems enabled with the 5G network. Since the communication channel is open, security and privacy in the system should be taken into account. Our work proposes a key distribution scheme for group healthcare services in 5G network environments. We construct various healthcare domains and apply the proposed scheme to the group services. The paper also introduces Single Sign-On (SSO), a cost-efficient solution, for multi-server architecture of the constructed system. Security and privacy of the scheme are enforced by a three-factor authentication mechanism (integrating smart card, password and biometrics) and strong user anonymity property. We provide security proof of the proposed scheme using various well-known tools including RoR model, BAN logic and AVISPA simulation. Results of various performance comparisons indicate that our scheme provides most functions and bears rational costs, compared with its related works.