Paper Details

The Single sign-on (SSO) is a new authentication mechanism that enables a legal user with a singlecredential to be authenticated by multiple service providers in a distributed computer network. Recently, Chang and Leeproposed a new SSO scheme and claimed its security by providing well-organized security arguments. In this paper,however, we demonstrative that their scheme is actually insecure as it fails to meet credential privacy and soundness ofauthentication. Specifically, we present two impersonation attacks. The first attack allows a malicious service provider,who has successfully communicated with a legal user twice, to recover the user’s credential and then to impersonate theuser to access resources and services offered by other service providers. In another attack, an outsider without anycredential may be able to enjoy network services freely by impersonating any legal user or a nonexistent user. Weidentify the flaws in their security arguments to explain why attacks are possible against their SSO scheme. Our attacksalso apply to another SSO scheme proposed by Hsu and Chuang, which inspired the design of the Chang–Lee scheme.Moreover, by employing an efficient verifiable encryption of RSA signatures proposed by Ateniese, we propose animprovement for repairing the Chang–Lee scheme. We promote the formal study of the soundness of authentication asone open problem.

Prof. Vaishali Arun Hiray, “Detection of Attacks on Single Sign-On Mechanism for Distributed Computer Networks”, International Journal of Advance Engineering and Research Development (IJAERD), Vol. 3, Issue 4, pp. 17-22, April 2016.