FPRESSO: Fast and Privacy-Preserving SSO Authentication With Dynamic Load Balancing for Multi-Cloud-Based Web Applications

SSO (single sign on) provides e-commerce users with easy access to applications and network resources, using a single, secure login identity. Web services (WS) based on SSO provide the potential to achieve interoperability of distributed electronic commerce (e-commerce) application integration among autonomous organizations, regardless of platforms, operating systems or languages. The most important challenge about the WS based on security SSO is the cost of implementation. After reviewing the paradigm of developing WS security standards and challenges, this paper presented a security model of JSON (JavaScript object notation) based on SSO architecture for e-commerce enterprise. The decentralized SSO security architecture is presented which is easy to integrate legacy system and new developed system.

With the widespread adoption of web applications and cloud services, the OAuth 2.0-based OpenID Connect (OIDC) Single Sign-on (SSO) protocol has become the core of modern digital identity authentication. Although the OIDC protocol itself has strict security specifications, its implementation in real-world web frameworks can introduce critical vulnerabilities, particularly the improper omission of the state parameter, which leads to severe authentication forgery risks. Existing research often overlooks these implementation-level flaws, especially from a formal analysis perspective. This paper addresses this gap by formally analyzing the authentication forgery attack resulting from the missing state parameter. We construct a high-fidelity web framework model and, using the Tamarin formal analysis tool, systematically analyze the flawed OIDC implementation. Specifically, we demonstrate an attack path where cross-site request forgery is leveraged as a vector to deceive the relying party, ultimately achieving identity binding forgery—linking the attacker’s identity to the victim’s session. In response to this forgery vulnerability, this article proposes and formally verifies corresponding patches to successfully defend against such attacks. Finally, this paper provides concrete guidance for developers. This research, through formal methods, characterizes a replicable authentication forgery pattern within modern web architectures, providing a robust theoretical and practical foundation for hardening SSO systems against such advanced forgery threats.

INFN-CNAF is one of the Worldwide Large Hadron Collider Computing Grid (WLCG) Tier-1 data centers, providing support in terms of computing, networking, storage resources and services also to a wide variety of scientific collaborations, ranging from physics to bioinformatics and industrial engineering [1]. Recently, several collaborations working with our data center have developed computing and data management workflows that require access to S3 storage services and/or the integration with POSIX capabilities. Nevertheless, the access to the data must be regulated by federated authentication and authorization mechanisms, such as OpenID Connect (OIDC), which is largely adopted by communities like WLCG [2] and within the European Open Science Cloud (EOSC) [3]. In the present work, the possibility to regulate POSIX access by integrating JSON Web Token (JWT) [4] authentication, provided by INDIGO-IAM as Identity Provider [5], with solutions based on S3 (for object storage) and WebDAV (for hierarchical storage) protocols has been evaluated an related results have been reported. In such respect, a comparison between the performance yielded by S3 and WebDAV protocols has been carried out within the same distributed environment with the aim to better identify the solution most suitable for the different use cases.

The increasing reliance on web applications across domains such as e-commerce, banking, healthcare, and enterprise systems has significantly amplified the importance of secure and reliable authentication mechanisms. Traditional password-based authentication methods are increasingly vulnerable to modern cyber threats, including phishing, brute force attacks, and credential stuffing, thereby necessitating the adoption of more advanced and robust authentication strategies. This study presents a comprehensive comparative analysis of modern authentication mechanisms in web applications, including Multi-Factor Authentication (MFA), OAuth 2.0, JSON Web Tokens (JWT), Single Sign-On (SSO), and biometric-based authentication systems. The research evaluates these mechanisms based on critical parameters such as security strength, usability, scalability, performance, and implementation complexity. It further examines architectural models, token-based frameworks, and federated identity systems that support secure user authentication in distributed environments. Additionally, the study reviews common vulnerabilities, threat mitigation techniques, and real-world deployment scenarios to assess the effectiveness of each approach. The findings highlight a growing shift toward hybrid authentication models that integrate multiple techniques to achieve enhanced security and user experience. However, challenges remain in balancing security with usability, ensuring interoperability across platforms, and maintaining privacy in decentralized systems. The paper concludes by identifying future research directions focused on passwordless authentication, zero-trust security models, and adaptive authentication systems for next-generation web applications.Keywords : Authentication mechanisms, Web application security, Multi-Factor Authentication (MFA), OAuth 2.0, JSON Web Tokens (JWT), Single Sign-On (SSO), Biometric authentication, Passwordless authentication, Zero Trust security, Cybersecurity

Now-a-days, cloud computing has become a cornerstone of modern technology, driving innovation, efficiency and accessibility across various industries and application. Distributed computing solves the difficulty of using distributed autonomous machines and communicating with each other over a network. Cloud computing provides clients with a range of services and capabilities that enhances productivity, accessibility and scalability while reducing the need for extensive hardware and infrastructure investments. When interest in distributed computing rises, it implies that more individuals, businesses, and organizations are exploring, adopting, and implementing distributed computing solutions. This surge in interest leads to increase in data traffic. There are two solutions for the issue of increase in data traffic, one is to server optimization (or) server performance enhancement (upgrade single server to a high performance server) but upgraded server may exceed its capacity (overload).Another one is multi servers. Ulti-server configurations are common in scenarios where the demands of an application or service exceed the capabilities of a single server, and the distribution of tasks across multiple servers is necessary for optimal performance and reliability. When there are multiple servers, there is an issue i.e. Load Adjusting. [1] Load balancing is one of the critical issues in cloud computing. In a cloud environment, where resources are often dynamically allocated and distributed, load balancing plays a central role in managing workloads efficiently. Load balancing in cloud computing is a technique used to distribute computing workloads and network traffic across multiple servers or resources within a cloud environment. The primary goal of load balancing is to optimize resource utilization, prevent individual servers from becoming overloaded, and ensure that the overall system can handle varying levels of demand efficiently. Here we also discussed about the hybrid of Cat and Mouse Optimization and Grey Wolf Optimization algorithms. This paper refers to Cloud Computing, Load balancing techniques, Load balancing algorithms.

A website of an entity (organization or enterprise) usually provides multiple services to its members. Once a user of the entity signs-on for a service, she can access all services available to her. This is known as single sign-on (SSO). For implementation of SSO, user authentication is separated, at least logically, from services. An identity provider (IDP) authenticates a user and a service provider (SP) delivers each service. Thus, a user has an active IDP session, and one active service session for each SP she is accessing. While SSO eases the life of users and system-administrators, if SSO not implemented carefully, a user may sign-out from all services but still may have an active IDP session, and users might not be aware of existence of the active IDP sessions. In this work, we use state-transition diagrams to trace the steps during a SSO activity, and then show the states that a user’s browser may maintain. We show that even after a user signs-out or timed-out from all service sessions or the IDP server session, active sessions may exist that the user maybe unaware of. This situation may happen because implementer never thought of this possibility or the user is unaware of such possibility or both. We propose some possible remedies to mitigate undesirable information-security situations we have exposed.

Logout in single sign-on systems: Problems and solutions

Single sign-on (SSO) is an identity management technique that provides the ability to use multiple Web services with one set of credentials. However, when the authentication server is down or unavailable, users cannot access these Web services, regardless of whether they are operating normally. Therefore, it is important to enable continuous use alongside SSO. In this paper, we present an identity continuance method for SSO. First, we explain four such continuance methods and identify their limitations and problems. Second, we propose a new solution based on an identifier migration approach that meets the requirement for identity continuance. Finally, we discuss these methods from the viewpoint of continuity, security, efficiency, and feasibility.

JavaScript Object Notation (JSON) has evolved to the de-facto standard file format in the web used for application configuration, cross- and same-origin data exchange, as well as in Single Sign-On (SSO) protocols such as OpenID Connect. To protect integrity, authenticity, and confidentiality of sensitive data, JavaScript Object Signing and Encryption (JOSE) was created to apply cryptographic mechanisms directly in JSON messages.We investigate the security of JOSE and present different applicable attacks on several popular libraries. We introduce JOSEPH (JavaScript Object Signing and Encryption Pentesting Helper) -- our newly developed Burp Suite extension, which automatically performs security analysis on targeted applications. JOSEPH's automatic vulnerability detection ranges from executing simple signature exclusion or signature faking techniques, which neglect JSON message integrity, up to highly complex cryptographic Bleichenbacher attacks, breaking the confidentiality of encrypted JSON messages. We found severe vulnerabilities in six popular JOSE libraries. We responsibly disclosed all weaknesses to the developers and helped them to provide fixes.

Any micro service-based programme, including alumni management software, must include load balancing. The effective use of resources is made possible by load balancing, which also ensures that application performance is unaffected by unexpected increases in requests or user usage. In an alumni management application, load balancing can be achieved with a combination of techniques such as round-robin scheduling, weighted load balancing, and dynamic scheduling. These techniques help to ensure that the application remains up and running, even during peak usage times. Additionally, load balancing can be used to ensure users get the best possible experience when using the application. By distributing traffic among multiple back-end services, users can expect faster response times and more reliable performance.Load balancing in a micro services-based alumni management application is a way of distributing incoming web traffic across multiple back end servers in order to efficiently manage traffic, reduce latency, and improve overall performance. Load balancing works by distributing incoming requests across a cluster of servers, and can be done either statically or dynamically. Static load balancing assigns each request to a specific server, while dynamic load balancing uses algorithms to decide which server should handle each request. In the alumni management application, load balancing is important for ensuring that requests are handled efficiently and that the system is not overwhelmed by too many requests. This is especially important when multiple users are accessing the application simultaneously. By distributing requests across multiple servers, the application can remain responsive and reliable even under heavy load.

SummaryJWTForge is a lightweight, open-source JSON Web Token (JWT) (RFC 7519) vending service designed specifically for developers and security researchers who need to test or surface vulnerabilities in the OAuth2 (RFC 6749) and OpenID Connect (OIDC) (see here) implementations.

Single Sign-On (SSO) is an authentication mechanism in which a Cloud Service Consumer (CSC) needs to be authenticated only once while accessing various services from multiple service providers, or when accessing multiple services from the same service provider. In the case of Cloud Federation, the consumers can get services from various Cloud Service Providers (CSPs) who are members of the federation, and SSO can be used to verify the legitimate users without requiring them to get authenticated with each service provider separately. CloudSim is a popular tool used for simulating various cloud computing scenarios. As of now, the simulator lacks effective user authentication and authorization methods with it. In this paper, we discuss the design and implementation of SSO mechanism in the Cloud Federation scenario using the CloudSim toolkit. We have used the Fully Hashed Menezes-Qu-Vanstone (FHMQV) protocol for the key exchange and the Symmetric Key Encryption technique AES-128 for encrypting the identity tokens. We give the workflow model for the proposed approach of SSO in the Cloud Federation and also, the execution time taken in the simulation for various Single Sign-On scenarios where the number of SSO required varies are also shown.

A Fuzzy set techniques which perhaps eliminate the several ambiguities on the particular issue to take right decision. Users may prefer the fuzzy approaches for their internal computation conflicts or manipulation to access boundless of data from cloud. Even though we have many security approaches, users are facing massive difficulties to safeguard their owning data in cloud environment. Protecting the confidential data from various hackers is the tedious problem in the current trend. So, possibly we will achieve the efficient security outcome by applying the different set of security principles. This proposed model is well suitable for securing the user confidential information's from the attackers in any situation. It focuses on clustering the different sort of input factors of customer validation attributes and evaluates these attributes to ensure the authenticity of unique users in cloud environment by ranking the distinguished threshold levels to prove user authentication function.

Application Programming Interface (API) merupakan antarmuka yang dibangun
\noleh pengembang sistem supaya sebagian atau keseluruhan fungsi sistem dapat
\ndiakses secara programmatis. Sementara Representational State Transfer (REST)
\nmerupakan salah satu gaya arsitektur dari pengembangan API yang menggunakan
\nHypertext Transfer Protocol (HTTP) dalam melakukan komunikasi data. Penelitian
\nini mengimplementasikan gaya arsitektur REST dalam pengembangan API sebagai
\nback-end sistem informasi administrasi pasien klinik perawatan kulit. API yang
\ndikembangkan menggunakan Javascript Object Notation (JSON) sebagai standar
\nformat dalam komunikasi data serta JSON Web Token (JWT) sebagai kode
\notentikasi pengguna pengguna. Penelitian ini menunjukkan bahwa pengembangan
\nAPI berhasil dilakukan pada administrasi pasien klinik perawatan kulit dan REST
\nyang diterapkan mempermudah pengembangan struktur API. Penelitian ini
\nmenghasilkan back-end sistem informasi administrasi pasien klinik perawatan kulit
\nberbasis REST API. API diuji dalam tiga tahap yakni pengujian JWT pada backend
\nserver berjumlah banyak, pengujian API dengan metode Equivalence
\nPartitioning dan pengujian fungsional sistem.
\nKata kunci: application programming interface (api), representational state
\ntransfer (rest), hypertext transfer protocol (http), javascript object
\nnotation (json), json web token (jwt).
\n
\n
\nABSTRACT
\n
\nApplication Programming Interface (API) is an interface built by system developer
\nso some or entire functions of the system can programmatically be accessed.
\nRepresentational State Transfer (REST) is one of API development architectural
\nstyle that uses Hypertext Transfer Protocol (HTTP) for data communication. This
\nresearch implemented REST in developing API as the back-end of the skincare
\nclinic patient information system. API was developed using Javascript Object
\nNotation (JSON) as the standard format for data communication and JSON Web
\nToken (JWT) as user authentication code. This research indicates that the
\ndevelopment of API successfully performed on the patient administration of skin
\ncare clinic and implementation of REST makes it easy to develop API structures.
\nThis research produced REST API-based back-end for the patient administration
\ninformation system of skin care clinic. API was tested in three stages: JWT testing
\non multiple back-end servers, API testing with Equivalence Partitioning and system
\nfunctional testing.
\nKeywords : application programming interface (api), representational state transfer
\n(rest), hypertext transfer protocol (http), javascript object notation
\n(json), json web token (jwt).

Authentication and load balancing scheme based on JSON Token For Multi-Agent Systems