A New Single Sign-on Solution in Cloud

Existing approaches for management of digital identities within e-learning ecosystems imply defining different access parameters for each service or application. However, this can reduce system security and lead to insufficient usage of the services by end-users. This chapter investigates various approaches for identity management, particulary in a cloud computing environment. Several complex issues are discussed, such as cross-domain authentication, provisioning, multi-tenancy, delegation, and security. The main goal of the research is to provide a highly effective, scalable identity management for end-users in an educational private cloud. A federated identity concept was introduced as a solution that enables organizations to implement secure identity management and to share information on the identities of users in the cloud environment. As a proof of concept, the identity management system was implemented in the e-learning system of Faculty of Organizational Sciences, University of Belgrade.

According to the requirements of the multiple municipal management information system integration, the principle and method for realizing cross-domain single sign-on in the municipal portal system is proposed. Based on analysis of the common single sign-on technology, this paper discusses designs of a CAS-based municipal portal single sign-on system. By storing user's authentication information on CAS server, this method solves the problems in cross-domain authentication and realizes the cross-domain single sign-on. Practical application shows that through the improvement of common CAS, the authentication and authorization can be separated, and municipal information system integration and sharing can be realized through established single sign-on municipal portal, thus providing convenience for the users to quickly access to the resources.

Emerging as the effective strategy of intelligent transportation system (ITS), vehicular ad hoc networks (VANETs) have the capacity of drastically improving the driving experience and road safety. In typical VANET scenarios, high mobility and volatility of vehicles result in dynamic topology of vehicular networks. That is, individual vehicle may pass through the effective domain of multiple neighboring road-side-units (RSUs) during a comparatively short time interval. Hence, efficient and low-latency cross-domain verification with all the successive RSUs is of significance. Recently, a lot of research on VANET authentication and key distribution was presented, while the critical cross-domain authentication (CDA) issue has not been properly addressed. Particularly, the existing CDA solutions mainly reply on the acquired confidential keying information from the neighboring entities (RSUs and vehicles), while too much trustworthiness is granted to the involved RSUs. Please note that the RSUs are distributively located and may be compromised or disabled by adversary, thus vital vehicle information may be revealed. Furthermore, frequent data interactions between RSUs and cloud server are always the major requisite so as to achieve mutual authentication with cross-domain vehicles, which leads to heavy bandwidth consumption and high latency. In this paper, we address the above VANET cross-domain authentication issue under the novel RSU edge networks assumption. Please note that RSUs are assumed to be semi-trustworthy entity in our design, where critical vehicular keying messages remain secrecy. Homomorphic encryption design is applied for all involved RSUs and vehicles. In this way, successive RSUs could efficiently verify the cross-domain vehicle with the transited certificate from the neighbor RSUs and vehicle itself, while the identity and secrets of each vehicle is hidden all the time. Afterwards, dynamic updating towards the anonymous vehicle identity is conducted upon validation, where conditional privacy preserving is available. Moreover, pairing-free mutual authentication method is used for efficiency consideration. Formal security analysis is given, proving that the HCDA mechanism yields desirable security properties on VANET cross domain authentication issue. Performance discussions demonstrate efficiency of the proposed HCDA scheme compared with the state-of-the-art.

In recent years, enterprise applications have begun to migrate from a local hosting to a cloud provider and may have established a business-to-business relationship with each other manually. Adaptation of existing applications requires substantial implementation changes in individual architectural components. On the other hand, users may store their Personal Identifiable Information (PII) in the cloud environment so that cloud services may access and use it on demand. Even if cloud services specify their privacy policies, we cannot guarantee that they follow their policies and will not (accidentally) transfer PII to another party. In this paper, we present Identity-as-a-Service (IDaaS) as a trusted Identity and Access Management with two requirements: Firstly, IDaaS adapts trust between cloud services on demand. We move the trust relationship and identity propagation out of the application implementation and model them as a security topology. When the business comes up with a new e-commerce scenario, IDaaS uses the security topology to adapt a platform-specific security infrastructure for the given business scenario at runtime. Secondly, we protect the confidentiality of PII in federated security domains. We propose our Purpose-based Encryption to protect the disclosure of PII from intermediary entities in a business transaction and from untrusted hosts. Our solution is compliant with the General Data Protection Regulation and involves the least user interaction to prevent identity theft via the human link. The implementation can be easily adapted to existing Identity Management systems, and the performance is fast.

The mutli-server environment of many Internet services available today such as Google, and the availability of Single Sign-On (SSO) solutions have brought about promising technologies. Many of these and similar applications provide clients with the ability sign on using one set of username and password alleviating the need of multiple identities and multiple password. Although promising, SSO mechanisms need to be extra robust and provide utmost authentication for their users. Due to the unidirectional nature of the authentication channel between the service provider and the client in SSO and the lack of a recent authentication key, researchers have pointed out vulnerabilities in such schemes leading to attacks such as impersonation attacks. In this paper, we present a keyless signature scheme that remedies the aforementioned problem. By utilizing a combination of a Merkle hash tree and a hash calendar, the identity provider in SSO periodically creates an authentication key used by the client and the service provider. Traffic between the latter two is secured by a one-way hash chain to achieve bidirectional authentication. The proposed scheme is evaluated by simulation experiments and communication and computation costs are employed for evaluation. The optimal length of the one-way hash chain between the service providers and the client is validated analytically.

Today’s cloud computing becomes more and more popular, and the cloud service also becomes a trend all over the world. Many kinds of cloud services have arisen, and they offer a more convenient and faster way to handle all works. When users start to rely on various services of cloud computing, they need to manage many accounts. It is inconvenient to remember a lot of accounts used for these cloud services. If users can just remember one account for these cloud services, it will become easier and simpler to use all service users needed. Here, we propose a scheme combing single sign-on and smart card to achieve logging into multiple cloud services securely and simply .

We describe the design and implementation of Web-Login Card, a smart card based Single Sign-On solution that relieves the users from remembering several username and passwords when authenticating themselves to various services on the internet. Due to its tamper-resistant storage for protecting authentication data and other personal information and cryptographic computation capabilities, smart card is an ideal token of choice in our implementation. Our solution is seamlessly integrated into the Firefox browser via a browser extension that allows users to authenticate themselves and easily manage personal information on the card. The browser extension is written using XUL, JavaScript and Java with LiveConnect providing the bridge between JavaScript and Java. javax. smartcardio library is used for the raw communication between the host and the smart card via APDU exchange using T=1 protocol.

Abstract: Today, identity management systems are widely used in different types of organizations, from academic and government institutions to large enterprises. An important feature of identity management systems is the Single Sign-On functionality. Single Sign-On allows users to authenticate once, and freely use all services and resources available to them afterwards. In this paper, we present the usage of Kerberos in identity management systems. An overview of Kerberos protocol, state of the art of identity management systems and different generic architectures for identity management is given in the paper. Also, we present a Single Sign-On identity management architecture proposal based on Kerberos protocol, and discuss its properties. Special attention was given to authentication, authorization and auditing.

Existing cloud-based Single Sign-on (SSO) model generally rely on token-based and secure API leveraging authentication standard models such as OAuth 2.0, FIDO 2, OpenID Connect. Even though these models enable secure and fast login experiences across websites and applications, most of them did not focus on the privacy of the SSO token generated for the authentication with many applications. In addition, they are incapable to support dynamic authorization binding of the multiple privileges of user in accessing multiple applications in the SSO token. In this paper, we propose a scheme called FPRESSO providing a fast and privacy-preserving SSO authentication system with anonymous authorization binding designed for multi-application environments hosted on cloud. We utilize random perturbation to safeguard the SSO token, which is structured as a JSON Web Token (JWT). Essentially, our approach stores tokens in cookies to efficiently manage access and facilitate SSO recovery. Additionally, we introduced the anonymous authorization binding protocol to bundle user roles and permissions of the user into the SSO token, enhancing the efficiency and agility of access control across applications. To deliver high scalability of the system in accommodating a large number of users in cloud environment, we introduced multi-threaded load balancing algorithm to dynamically handle both SSO token generation and verification requests, ensuring efficient distribution of load across multiple servers. We conducted experiments to assess the performance of our proposed system. The results show that the token generation and verification processes are more efficient than those in comparable studies. By implementing the new cookie strategy, latency decreased significantly compared to the method without cookies.

Healthcare digitalization has turned out to be a significant paradigm in the advancement of medical sector. Resultant, there is production of huge volume of patient’s digital information. Moreover, storing and safeguarding such information tends to become a critical point of concern. The cloud technology assures to be an effective mechanism towards handling and distributing healthcare information by attending the concerns pertaining to data integrity, security and privacy. The significant benefits and accessibility offered by the cloud technology has immensely raised the storage of healthcare information. It’s highly important that the sensitive healthcare data residing in the cloud is completely secured amidst the healthcare providers and the cloud server. There has been a rising concern associated with secured data access within the cloud environment. That is, the cloud framework must assure a robust authentication control mechanism which allows the healthcare users to confidently share medical information across it. Towards accomplishing the same, a secured and light weight data access management system has been recommended that promises data Integrity and Security. Moreover, the proposed system offers the feature of authority control authorization and authentication mechanism for safeguarding the health-related data residing and circulating within the cloud. A CIAM (Customer identity and access management) helps in secured Data Access Control and OAuth 2.0 aids in providing right privilege with authorisation. Also, by the means of Progressive Attribute Based Encryption approach, sensitive medical information can be encrypted from the cloud storage in a secure manner. The proposed light weight framework yields in efficient, reliable and stable output within the cloud.

Increasing research has indicated a strong association between identity functioning and eating disorder (ED) symptomatology. However, a detailed investigation of identity throughout ED treatment is lacking. The present longitudinal study examined identity in inpatients with an ED and explored its simultaneous change with ED symptomatology throughout treatment. A total of 225 female patients completed questionnaires at admission. From these 225 patients participating at admission (Wave 1), 110 also participated in at least one additional measurement wave, with 43.64% (n = 48) participating at admission and during treatment, 16.36% (n = 18) participating at admission and at discharge, and 40% (n = 44) participating at admission, during treatment and at discharge. Questionnaires on identity synthesis, identity confusion, identity processes, and ED symptomatology were completed. Latent growth curve modeling was used to address the research questions. Throughout treatment, a decrease in identity confusion and an increase in identity synthesis and adaptive identity processes were found. Accordingly, increases in identity synthesis and identification with commitment were related to general decreases in the drive for thinness and body dissatisfaction. Similarly, such decreases in ED symptoms were related to general decreases in identity confusion and ruminative exploration. The present study points to an increase in identity functioning throughout treatment, and longitudinal associations between identity functioning and ED symptomatology were found. Helping patients to decrease their ruminative exploration and to increase their identification with previously made life commitments and treating body/weight concerns could both be helpful in ED treatment.

Over the past decade, JavaScript-based single-page application frameworks, including Meta's React.js, Google's Angular, and Vue.js, have become a popular technology choice for enterprise web application development teams. Increasingly, enterprise teams are architecting applications built upon these frameworks to utilize OAuth 2.0 with Open ID Connect to integrate with commercial Identity as a Service, Identity and Access Management, and Single Sign-On solutions. The security guarantees of OAuth 2.0 depend upon a client's secure handling and management of bearer tokens. Two conditions create significant uncertainty concerning a browser-based application's ability to meet this demand. First, modern browsers lack a storage facility with the necessary characteristics to protect tokens from abuse or exfiltration via cross-site scripting. Second, substantial portions of the codebase in a typical modern enterprise web application comprise third-party code and components sourced via a supply chain that remains a known attack-vector for cross-site scripting vulnerabilities. Presently, the lowest risk approach for integrating OAuth 2.0 with browser-based single-page applications is to employ a dedicated server-side component as the OAuth 2.0 client, allowing tokens to be retrieved through a secure backchannel and stored in a more highly trusted server-side execution environment. A correlation of the user's authenticated session between the server backend and the browser application is maintained using the much more solid, mature, and well-understood HTTP cookie mechanism. Such an architecture is described and referred to as the OAuth 2.0 Backend for Frontend (BFF) Architecture in a draft IETF specification. The draft specification provides a high-level description and depiction of the components and flows involved. This work's primary focus and contribution is a proposed theoretical extension addressing specific aspects of the OAuth 2.0 BFF Architecture described in the draft IETF OAuth 2.0 for Browser-based Apps specification. The proposed extension addresses critical and difficult-to-manage concerns that the draft leaves for implementing teams to handle. This research aims to assist researchers and practitioners in producing secure and robust browser-based OAuth 2.0 implementations with a solid user and developer experience.

The security of web-based services is currently playing a vital role for the software industry. In recent years, many technologies and standards have emerged in order to handle the security issues related to web services. This paper shows techniques to enhance the security of web services, and some of the recent challenges and recommendations of a proposed model to secure web services. It shows the security process of a real life web application, which includes; HTML5 forms, login security, and a single signon solution. This paper also aim to discuss the ten (10) most common web security vulnerabilities and how to prevent the web application from three (3) of the vulnerabilities. Amongst them are; SQL Injection, Cross Site Scripting and Broken Authentication, and Session Management.

Identity management consists of the processes and all underlying technologies for the creation, management, and usage of digital identities. Business rely on identity management systems to simplify the management of access rights to their systems and services for both their employees and their customers. Users may benefit from identity management to simplify logging in to websites and computer systems (single sign-on), as well as streamlining management of their personal information and preferences (user centricity). Current systems for identity management only partially achieve these goals, and still suffer from several security, privacy and usability issues. We will discuss how personal mobile devices (like mobile phones and PDA's) can be used to overcome this 'identity crisis', to increase the security, privacy and usability of identity management systems.

Single Sign-On (SSO) is an authentication mechanism in which a Cloud Service Consumer (CSC) needs to be authenticated only once while accessing various services from multiple service providers, or when accessing multiple services from the same service provider. In the case of Cloud Federation, the consumers can get services from various Cloud Service Providers (CSPs) who are members of the federation, and SSO can be used to verify the legitimate users without requiring them to get authenticated with each service provider separately. CloudSim is a popular tool used for simulating various cloud computing scenarios. As of now, the simulator lacks effective user authentication and authorization methods with it. In this paper, we discuss the design and implementation of SSO mechanism in the Cloud Federation scenario using the CloudSim toolkit. We have used the Fully Hashed Menezes-Qu-Vanstone (FHMQV) protocol for the key exchange and the Symmetric Key Encryption technique AES-128 for encrypting the identity tokens. We give the workflow model for the proposed approach of SSO in the Cloud Federation and also, the execution time taken in the simulation for various Single Sign-On scenarios where the number of SSO required varies are also shown.