NDLI: Audit based privacy preservation for the OpenID authentication protocol

Content Provider	IEEE Xplore Digital Library
Author	Riesch, P.J. Xiaojiang Du
Copyright Year	2012
Description	Author affiliation: Department of Computer and Information Sciences, Temple University, Philadelphia, Pennsylvania, USA (Riesch, P.J.; Xiaojiang Du)
Abstract	This paper studies a privacy vulnerability within OpenID, a distributed single sign on protocol. An OpenID system consists of three components: User Agent (UA); Relying Party - A web application that a UA would like to authenticate with using their unique identifier; and Identity Provider - A web server that provides a globally unique identifier for the UA and validates the identity of UAs on behalf of Relying Parties. The privacy vulnerability has been identified in existing literatures. However, no effective solution has been proposed to date. In this paper, we present an effective scheme to mitigate this vulnerability. In order for OpenID to gain wider acceptance, this vulnerability must be addressed with a solution that is convenient to the users of single sign on. We propose a method for mitigating this vulnerability by creating vertical levels of trust between constituents of an OpenID network through expanding the role of OpenID Identity Providers to include auditing OpenID Relying Parties for privacy vulnerabilities. In addition, Identity Providers may keep records of audits that identify Relying Parties that do not protect the privacy of OpenID users. The primary issue with this privacy vulnerability is that it is completely transparent - it occurs without the user ever being aware that it is happening. We cannot force Relying Parties to guarantee the privacy of OpenID users, nor would we like to burden individual users with browser level solutions that are often overly technical and difficult to understand. We have designed an audit solution at the level of the Identity Provider, which can accurately inform users when Relying Parties may be sharing information with third parties, therefore giving OpenID users the ability to make a conscious choice to share that information. We have performed real network experiments to validate our scheme, and the experimental results show that our scheme is effective.
Starting Page	348
Ending Page	352
File Size	418967
Page Count	5
File Format	PDF
ISBN	9781467327084
e-ISBN	9781467327091
DOI	10.1109/THS.2012.6459873
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2012-11-13
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Privacy Protocols security Authentication Computer applications distributed systems privacy Browsers IP networks OpenID authentication
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Heuristic authentication protocol for TCP/IP network applications under UNIX

Effective Attacks in the Tor Authentication Protocol

Towards a new user Anonymity Preserving Protocol (APP) for MANETs

Authentication and payment protocol preserving location privacy in mobile IP

A Privacy Preserving Security Protocol-Based Application for Wireless Communication System

User Identity for WebRTC Services: A Matter of Trust

GMSP: a generalized multi-hop security protocol for heterogeneous multi-hop wireless network

A Hash-Based Authentication Protocol for Secure Mobile RFID Systems

Security analysis of two anonymous authentication protocols for distributed wireless networks

Audit based privacy preservation for the OpenID authentication protocol

Similar Documents

Heuristic authentication protocol for TCP/IP network applications under UNIX

Effective Attacks in the Tor Authentication Protocol

Towards a new user Anonymity Preserving Protocol (APP) for MANETs

Authentication and payment protocol preserving location privacy in mobile IP

A Privacy Preserving Security Protocol-Based Application for Wireless Communication System

User Identity for WebRTC Services: A Matter of Trust

GMSP: a generalized multi-hop security protocol for heterogeneous multi-hop wireless network

A Hash-Based Authentication Protocol for Secure Mobile RFID Systems

Security analysis of two anonymous authentication protocols for distributed wireless networks

Audit based privacy preservation for the OpenID authentication protocol