Single Sign-on Research Articles

The DODAS Experience on the EGI Federated Cloud

The EGI Cloud Compute service offers a multi-cloud IaaS federation that brings together research clouds as a scalable computing platform for research accessible with OpenID Connect Federated Identity. The federation is not limited to single sign-on, it also introduces features to facilitate the portability of applications across providers: i) a common VM image catalogue VM image replication to ensure these images will be available at providers whenever needed; ii) a GraphQL information discovery API to understand the capacities and capabilities available at each provider; and iii) integration with orchestration tools (such as Infrastructure Manager) to abstract the federation and facilitate using heterogeneous providers. EGI also monitors the correct function of every provider and collects usage information across all the infrastructure. DODAS (Dynamic On Demand Analysis Service) is an open-source Platform-as-a-Service tool, which allows to deploy software applications over heterogeneous and hybrid clouds. DODAS is one of the so-called Thematic Services of the EOSC-hub project and it instantiates on-demand container-based clusters offering a high level of abstraction to users, allowing to exploit distributed cloud infrastructures with a very limited knowledge of the underlying technologies.This work presents a comprehensive overview of DODAS integration with EGI Cloud Federation, reporting the experience of the integration with CMS Experiment submission infrastructure system.

Promoting Quality Face-to-Face Communication during Ophthalmology Encounters in the Electronic Health Record Era.

To evaluate informatics-enabled quality improvement (QI) strategies for promoting time spent on face-to-face communication between ophthalmologists and patients. This prospective study involved deploying QI strategies during implementation of an enterprise-wide vendor electronic health record (EHR) in an outpatient academic ophthalmology department. Strategies included developing single sign-on capabilities, activating mobile- and tablet-based applications, EHR personalization training, creating novel workflows for team-based orders, and promoting problem-based charting to reduce documentation burden. Timing data were collected during 648 outpatient encounters. Outcomes included total time spent by the attending ophthalmologist on the patient, time spent on documentation, time spent on examination, and time spent talking with the patient. Metrics related to documentation efficiency, use of personalization features, use of team-based orders, and note length were also measured from the EHR efficiency portal and compared with averages for ophthalmologists nationwide using the same EHR. Time spent on exclusive face-to-face communication with patients initially decreased with EHR implementation (2.9 to 2.3 minutes, p = 0.005) but returned to the paper baseline by 6 months (2.8 minutes, p = 0.99). Observed participants outperformed national averages of ophthalmologists using the same vendor system on documentation time per appointment, number of customized note templates, number of customized order lists, utilization of team-based orders, note length, and time spent after-hours on EHR use. Informatics-enabled QI interventions can promote patient-centeredness and face-to-face communication in high-volume outpatient ophthalmology encounters. By employing an array of interventions, time spent exclusively talking with the patient returned to levels equivalent to paper charts by 6 months after EHR implementation. This was achieved without requiring EHR redesign, use of scribes, or excessive after-hours work. Documentation efficiency can be achieved using interventions promoting personalization and team-based workflows. Given their efficacy in preserving face-to-face physician-patient interactions, these strategies may help alleviate risk of physician burnout.

Kerberos Authorization with Hybrid Access Control Model in Public Cloud

Access control and Data confidentiality are key technology to ensure the security of system and to protect the privacy of the users. The modified Collaborative Trust Enhanced Security (CTES) model has an inbuilt access control mechanism for Kerberos protocol itself to enforce the access control policy directly into the Client system node. This paper explains the hybrid access control model with Role Based Access Control (RBAC) and Attribute Based Access Control (ABAC) for modified CTES framework through Kerberos protocol. Hence, it retains the concept of “role”, “group” and “attributes” for the user which are necessary to protect data privacy in the system. Data confidentiality for the stored data in Cloud is achieved by cryptographic techniques. Gnu Privacy Guard (GnuPG) based certificate is capable enough to verify the identity of the correspondent in information exchange as well as the information integrity. It is a strongest authentication technique where the user is asked to provide his/her digital ID for validation in the Server and enables Single sign-on services for Kerberos Authorization in modified CTES model. In this paper, it is proposed for a new Kerberos Authorization with Hybrid Access Control Model (KAHAC) for single-domain systems and multi-domain systems in Public Cloud based on roles, attributes, groups, access modes and the type of resources.

Usability and privacy in academic libraries: regaining a foothold through identity and access management

Benefits arising from initiatives to streamline the user experience for academic researchers and students must be balanced against GDPR and information security measures that institutions must take to protect their members’ personal data. Using the example of Bath Spa University Library’s role in single sign-on projects in collaboration with the IT department and a third-party software supplier, a way in which academic libraries can more robustly enter the conversation surrounding user privacy is suggested. Identity and access management is one area of collaboration in which the librarian’s traditional commitment to patron or user privacy can be upheld.

Anonymous Single Sign-On With Proxy Re-Verification

An anonymous single sign-on (ASSO) scheme allows users to access multiple services anonymously using one credential. We propose a new ASSO scheme, where users can access services anonymously through the use of anonymous credentials and unlinkably through the provision of designated verifiers. Notably, verifiers cannot link a user's service requests even if they collude. The novelty is that when a designated verifier is unavailable, a central authority can authorize new verifiers to authenticate the user on behalf of the original verifier. Furthermore, a central verifier can also be authorized to de-anonymize users and trace their service requests. We formalize the scheme along with a security proof and provide an empirical evaluation of its performance. This scheme can be applied to smart ticketing where minimizing the collection of personal information of users is increasingly important to transport organizations due to privacy regulations such as general data protection regulations (GDPRs).

Adaptive security architectural model for protecting identity federation in service oriented computing

With the tremendous growth of Internet and its related technologies, the Service Oriented Architecture (SOA) became a dominant paradigm shift for enterprise computing. In SOA, business functionalities are offered by many different Service Providers as services. In order to get served by different service providers, the client has to authenticate with those service providers at multiple times. Single Sign On (SSO) mechanism provides the client to login only one time so that access to different services is made possible without needing to re-authenticate. Here, the identity of the logged-in client is federated among the enterprise computing nodes. This is one of the simplest forms of federated identity. The goal of identity federation is to benefit ease of use, flexibility, productivity and reduced cost of the authentication process, but trust and security is a major concern in this situation. Major threats on federated identity management are due to identity misuse, identity theft, and trust deficit between identity providers and services providers. As of now, the Security Assertion Markup Language (SAML), Open Authorization (OAuth) and OpenID are the three important federated identity management standards in the industry. However, none of them is equipped by itself to provide comprehensive security protection for identity federation even within a single enterprise computing environment. In fact, these federated solutions result in additional security vulnerabilities due to their openness of identity federation. The security threats are becoming severe when federated identity is spanned into the inter-organizational and intra-organizational computing environment. This paper analyses the vulnerabilities and security gaps in the existing federated identity solutions. To overcome these gaps, an adaptive security architectural model is proposed for identity federation at inter and intra-organizational level using public key infrastructure that adheres to the SOA security standards and specifications. The proposed architecture is implemented and tested in a large-scale federated identity enterprise computing environment with security-centric financial data to acquire the desired results. A cross-sectional comparative analysis is done between existing and proposed solutions to validate the improvement in the protection of identity federation environment.

Engineering Authentication Process with Cloud Computing

Cloud computing is a way to increase the capacity or add capabilities dynamically without any upfront investments. Despite the growth achieved from the cloud computing, security is still questionable which impacts the cloud model adoption. Aside of having network and application securities being adopted, there must be a security that authenticate the user when accessing the cloud services that is bound to the rules between the cloud computing provider and the client side. The existing system provides authentication based on keys Encryption algorithms either symmetric key-based or asymmetric are key-based. Both encryption approaches have a major problem related to encryption key management i.e. how to securely generate, store, access and exchange secrete keys. In this paper, an optimized infrastructure for secure authentication and authorization in Cloud Environment using SSO (Single Sign-On) is proposed. SSO is a process of authenticating once and gain access of multiple resources that aims at reducing number of login and password in heterogeneous environment and to gain balance in Security, Efficiency and Usability. Also an authentication model for cloud computing based on the Kerberos protocol to provide single sign-on and to prevent against DDOS attacks is also presented in this paper.

Security methods and approaches for internal and external network hospital information systems with single sign-on

Hospital information systems are vast and very complex, and include a variety of services. They have become a necessity nowadays, both due to the value added services they provide and to their penetration in the healthcare market. Yet, there is a variety of security issues that need to be met and overcome in order to build robust hospital information systems. This paper suggests several security measures in order to enhance security of the sensitive medical data both in an intranet and an extranet environment, and to provide value-added services for efficient health information management. The authors propose an architecture that enables the integration of such security measures in a HIS, especially with the use of SSO, which can cover a wide range of applications.

Center-Less Single Sign-On With Privacy-Preserving Remote Biometric-Based ID-MAKA Scheme for Mobile Cloud Computing Services

Identity-based mutual authentication and key agreement (ID-MAKA) between a mobile user and cloud service provider is necessary for accessing any cloud services. In recent years, there are a large number of ID-MAKA schemes had been proposed on mobile cloud computing services to make authentication and accessing process more usability, security, and scalability. In this paper, we propose a new ID-MAKA scheme for mobile cloud computing, which firstly achieves remote biometric-based authentication(remote servers authenticate user’s biometrics), single sign-on (a single credential and single registration for accessing multiple servers) and center-less authentication(the registration center does not participate in the access procedure) in one scheme. In order to realize this target, we design a ZK-token based on ECC and cryptographic hash function, and then artfully employ it to introduce the fuzzy extractor technology and zero-knowledge technology into our scheme. Therefore, the user can access multiple cloud computing servers by registering only once in the registration center, and cloud computing servers can complete the biometric-based remote authentication and key agreement for the user without the registration center participating. In this way, our scheme greatly improves usability, scalability, and security compared to other existing solutions. We give a formal security proof for our scheme by using Real-Or-Random(RoR) model and Burrows-Abadi-Needham (BAN) logic to show that the present scheme is secure and security analysis for other known attacks. Finally, according to the experiment result, our scheme has lower computation and communication cost compared with most existing related schemes.

Security methods and approaches for internal and external network hospital information systems with single sign-on

Hospital information systems are vast and very complex, and include a variety of services. They have become a necessity nowadays, both due to the value added services they provide and to their penetration in the healthcare market. Yet, there is a variety of security issues that need to be met and overcome in order to build robust hospital information systems. This paper suggests several security measures in order to enhance security of the sensitive medical data both in an intranet and an extranet environment, and to provide value-added services for efficient health information management. The authors propose an architecture that enables the integration of such security measures in a HIS, especially with the use of SSO, which can cover a wide range of applications.

Virtual Identity Performance Evaluations of Anonymous Authentication in IDaaS Framework

Identity-as-a-Service (IDaaS) is one of the most famous fruitful authentication services for cloud deployment to the Software-as-a-Service (SaaS) model. It is a third party approach for identity management, including creation, authentication, and privacy assurance. In this paper, the Virtual Identity ( $V_{ID}$ ), as a new realization for IDaaS terminology which can be used in virtual environments, is proposed to improve the user privacy and to provide the anonymous Single sign-on (SSO) in such types of distributed environments. Actually, two $V_{ID}$ frameworks based on the Identity-Based Encryption (IBE) and Pseudonym-Based Encryption (PBE) approaches are proposed and then implemented using $MIRACL$ library. The $V_{ID}$ approaches performance is evaluated analytically by implementing a mathematical model based on $BCMP$ (Baskett Chandy Muntz Palacios) queuing model. In addition, a simulation-based evaluation using $OPNET$ Modeler is introduced to compare the analytical-based $BCMP$ queuing model against the $OPNET$ simulation results. Moreover, the proposed approaches are compared against state-of-the-art work.

Systematic Literature Review on the LDAP Protocol As a Centralized Mechanism for the Authentication of Users in Multiple Systems

.

A Novel Authentication Mechanism to Prevent Unauthorized Service Access for Mobile Device in Distributed Network

The growth of distributed computer networks (DCN) is simple for the user to share information and computing capabilities with the host. User identification is an essential access control mechanism for the client-server networking architecture. The perception of single sign-on allows a legitimate user to access a different service provider on a DCN using a single session key. Recently, several user identification techniques being proposed for DCN. Unfortunately, the existing proposals cannot maintain user anonymity when the majority of probable attacks. In addition, the further time synchronization mechanism they use can result in widespread overhead costs. To overcome these shortcomings, we propose a novel authentication mechanism to prevent unauthorized service access for a mobile device in distributed networks. The mechanism implements methods to generate securely encrypted keys using RSA algorithm to validate the authentication of user login id and password. Later, it implements a secure session key generation using DH algorithm which allows accessing the different services without repeating the authentication mechanism. An experimental evaluation was performed to measure execution time overhead for the registration process, an authentication process, session key generation process and Service Request Performance. The comparison results with existing authentication mechanism show an improvisation in all the measures.

Analysis of CEISA Services User Satisfaction Using the EUCS Method in The Directorate General of Customs and Excise

The purpose of this study is to analyze the factors that influence the satisfaction of users of CEISA services (Customs & Excise Information System and Automation) at the Directorate General of Customs and Excise (DGCE). CEISA uses Single Sign-On (SSO) technology, meaning that users only do one login to be able to access all applications in accordance with their authority. Therefore, the CEISA database and server are centrally managed so that they can be accessed throughout the DGCE office. But in practice there are still DGCE offices that develop independent applications. User satisfaction is one of the important factors that influence the success of implementing an information system. This study uses the End-User Computing Satisfaction (EUCS) method as an indicator of research. The variables tested in this study were 100 respondents as samples taken from employees at the Tanjung Priok Type A Customs and Excise Service Office (CESO). Data analysis using Multiple Linear Regression Test with IBM SPSS Statistics 25 as a tool to process data. There are five hypotheses proposed in this study. The results showed that all proposed hypotheses were accepted. That is, all variables in the EUCS method have a positive and significant effect on CEISA service user satisfaction in the DGCE environment.

Common ELIXIR Service for Researcher Authentication and Authorisation.

A common Authentication and Authorisation Infrastructure (AAI) that would allow single sign-on to services has been identified as a key enabler for European bioinformatics. ELIXIR AAI is an ELIXIR service portfolio for authenticating researchers to ELIXIR services and assisting these services on user privileges during research usage. It relieves the scientific service providers from managing the user identities and authorisation themselves, enables the researcher to have a single set of credentials to all ELIXIR services and supports meeting the requirements imposed by the data protection laws. ELIXIR AAI was launched in late 2016 and is part of the ELIXIR Compute platform portfolio. By the end of 2017 the number of users reached 1000, while the number of relying scientific services was 36. This paper presents the requirements and design of the ELIXIR AAI and the policies related to its use, and how it can be used for serving some example services, such as document management, social media, data discovery, human data access, cloud compute and training services.

Token-based Single Sign-on with JWT as Information System Dashboard for Government

Various web-based information systems are developed by Indonesian government to improve quality of services for their society. It encourages users, generally civil servants, to perform different authentications on used information systems and have to remember credentials. Account management of the users poses another challenge for administrators. Single Sign-On (SSO) can be the solution by providing a service of centralized authentication and user account management. This study applies a token-based SSO architecture and uses Json Web Token (JWT) to grant permission authorities, since JWT can provide a claim process between 2 parties. Additionally, the built-in dashboard lists associated information systems to facilitate accessing for the authenticated users. This study will discuss JWT implementation on the dashboard of government information systems that implements SSO, which will generate the permission authorities securely for connected information systems on SSO.

Improved User Authentication Process for Third-Party Identity Management in Distributed Environment

Third-party identity management user authentication process using single sign-on (SSO) in distributed computer networks requires modification as the process of authenticating user to log into relying party (RP) resources by either identity provider (IDP) or hybrid relying party (HRP) depend always on the authentication of user logins. In this research an algorithm is proposed to authenticate user only once by recording and encrypting user credential with one-way hashing algorithm (SHA2), this simplifies user subsequent logins into relying party by confirming user credentials without other authentication by IDP or HRP. Authentication time and response time continuous time plot of the proposed algorithm was plotted with respect to the arrival time of users in which we show the relationship of authentication time and response time with random arrival rate of users.

Android single sign-on security: Issues, taxonomy and directions

Single Sign-On (SSO) is a mechanism that allows a user to log in to other applications using his identity registered with an identity provider. One of the most popular protocols for SSO is OAuth 2.0, which is an open standard for authorization. However, due to the lack of detailed instructions on how to implement OAuth 2.0 on Android, there are many vulnerabilities in the current Android OAuth 2.0 implementations. While much research effort has been made to exploit such vulnerabilities, there is a lack of systematical collation and summary of these researches, resulting in the appearance of common vulnerabilities in new applications. Hence, it is crucial to collate and summarize related work. Meanwhile, the rapid development of the Internet of Things (IoT) also requires an understanding of the usage of OAuth 2.0 in the IoT environment.In this work, we first describe the OAuth 2.0 authorization code grant flow and the implicit grant flow in detail and summarize the differences between the Web environment and the Android environment that affect OAuth 2.0 security. Then, we summarize the security issues in the implementations of OAuth 2.0 on Android. These security issues include: storing client_secret or access token locally, using embedded WebView as user-agent, incorrect usage of authentication proof, handling redirection in mobile app improperly, lacking transmission protection and third-party app authentication. Attacks on these vulnerabilities, such as WebView hijacking, linking hijacking and phishing, as well as attack results are elaborated subsequently. Against these security issues and attacks, we summarize the related research work in terms of vulnerability analysis, defense, and protocol analysis. At last, we discuss the directions for mitigating these security issues and discuss some OAuth-based protocols for the IoT environment.

META-pipe Authorization service.

We describe the design, implementation, and use of the META-pipe Authorization service. META-pipe is a complete workflow for the analysis of marine metagenomics data. We will provide META-pipe as a web based data analysis service for ELIXIR users. We have integrated our Authorization service with the ELIXIR Authorization and Authentication Infrastructure (AAI) that allows single sign-on to services across the ELIXIR infrastructure. We use the Authorization service to authorize access to data on the META-pipe storage system and jobs in the META-pipe job queue. Our Authorization server was among the first SAML2 service providers that integrated with ELIXIR AAI. The code is open source at: https://gitlab.com/uit-sfb/AuthService2.

Integrasi Sistem Single Sign On Pada Sistem Informasi Akademik, Web Information System Dan Learning Management System Berbasis Central Authentication Service

Elearning and web based information systems is a means to communicate and exchange information for academic purposes. Nowadays lightweight directory access protocol (LDAP) is a state of the art method of choice. With LDAP technologies user only need one username and password to access to multiple web based application, The problem is if the user wanted to do autentification said user had to input their credentials over and over again for each application. To solve that problem single sign on mechanism (SSO) is invented. With SSO user only need login once and they got all the same credentials with them to all intergrated application wthin the campus. To implement the SSO we use Central authentication service (CAS) as a authentifiation central within LDAP structure as a user management. In this reseach we see that single sign on (SSO) system that intergrated into student management system, E-Learning system and Internal blog system both use of database based system or even LDAP based system.