Abstract:Identity management (IdM) plays a significant role in managing user identities (IDs). However, IdM is challenging to handle the rapidly rising numerous kinds of Web-based applications nowadays. The OpenID 2.0 communication protocol is an improved solution for managing a user's IDs based on the OpenID URL identity. OpenID URL identity is not very much secure in specific Web-based attacks; for instance, session hijacking and phishing attacks often occur. The earlier OpenID-based methods secure OpenID URL identity with single, double, and triple authentication schemes. But Identity Provider (IdP) side is still not secure in Web attacks: if an attacker steals the IdP-side legal user information, then existing OpenID-based security techniques are unreliable. The anticipated OpenID Reverse Authentication Authorizing and Accounting (RAAA) user authentication-based protocol secured OpenID URL identity by providing two beneficial fields Secret Alphanumeric String (SAS) and Special Innovative PIN (SIP) that utilize in testing website both sides in reverse and cost-effective way. In this experiment, IdP and Relying Party (RP), both sides are being used secretly. Therefore, experimental websites also test to check the proposed triple authentication protocol. In this paper, we have compared our RAAA user authentication protocol with already available SSO protocol methods. The tested websites and comparative results represent that the anticipated design protocol is very much secure and reliable solution. The advanced cryptographic Single-Sign-On (SSO) secure protocol reduces the higher-level session hijacking and phishing attacks risk in an OpenID-based environment. We suggest future SSO protocol methods will be needed more in terms of the authorized user's identity authentication in Web-based applications.

On the Security of Online/Offline Signatures and Multisignatures from ACISP’06

An Inter-Domain Authentication Scheme For Pervasive Computing Environment

Evaluation of Secure OpenID-Based RAAA User Authentication Protocol for Preventing Specific Web Attacks in Web Apps

A Novel User Authentication Scheme Using Smart Cards.

An advanced signature system for OLSR

Security Analysis of an Identity-Based Signature from Factorization Problem

On the security of an identity based multi-proxy signature scheme

An efficient dynamic ID based remote user authentication scheme using self-certified public keys for multi-server environment

A New Attack for Self-Certified Digital Signatures for E-commerce Applications.

Digital Signature Scheme Based on Multi-Dimensional Hash Chains for Ad-Hoc Wireless Routing Security

An Efficient Certificateless Signature Scheme With Provably Security and Its Applications

An Efficient Conditional Privacy-Preserving Authentication Scheme for Vehicular Ad Hoc Networks Using Online/Offline Certificateless Aggregate Signature

Low-Latency Authentication Against Satellite Compromising for Space Information Network

Attack on Digital Multi-Signature Scheme Based on Elliptic Curve Cryptosystem.

Online/Offline Signatures for Low-Power Devices

A DoS and fault-tolerant authentication protocol for group communications in ad hoc networks

Certificateless Signature: a New Security Model and an Improved Generic Construction

SUAA: A Secure User Authentication Scheme with Anonymity for the Single & Multi-server Environments.

On the Security of an Efficient Attribute-Based Signature.

An authentication and signature scheme for UAV-assisted vehicular ad hoc network providing anonymity

A Novel Multiserver Authentication Scheme Using Proxy Resignature With Scalability and Strong User Anonymity