Abstract:Identity management (IdM) plays a significant role in managing user identities (IDs). However, IdM is challenging to handle the rapidly rising numerous kinds of Web-based applications nowadays. The OpenID 2.0 communication protocol is an improved solution for managing a user's IDs based on the OpenID URL identity. OpenID URL identity is not very much secure in specific Web-based attacks; for instance, session hijacking and phishing attacks often occur. The earlier OpenID-based methods secure OpenID URL identity with single, double, and triple authentication schemes. But Identity Provider (IdP) side is still not secure in Web attacks: if an attacker steals the IdP-side legal user information, then existing OpenID-based security techniques are unreliable. The anticipated OpenID Reverse Authentication Authorizing and Accounting (RAAA) user authentication-based protocol secured OpenID URL identity by providing two beneficial fields Secret Alphanumeric String (SAS) and Special Innovative PIN (SIP) that utilize in testing website both sides in reverse and cost-effective way. In this experiment, IdP and Relying Party (RP), both sides are being used secretly. Therefore, experimental websites also test to check the proposed triple authentication protocol. In this paper, we have compared our RAAA user authentication protocol with already available SSO protocol methods. The tested websites and comparative results represent that the anticipated design protocol is very much secure and reliable solution. The advanced cryptographic Single-Sign-On (SSO) secure protocol reduces the higher-level session hijacking and phishing attacks risk in an OpenID-based environment. We suggest future SSO protocol methods will be needed more in terms of the authorized user's identity authentication in Web-based applications.

A PKI-based Single Sign-on Scheme for Web Application

An Inter-Domain Authentication Scheme For Pervasive Computing Environment

Inter-domain authentication scheme for Pervasive Computing Environments

A PRIVACY-PRESERVING AUTHENTICATION SCHEME USING BIOMETRICS FOR PERVASIVE COMPUTING ENVIRONMENTS

Evaluation of Secure OpenID-Based RAAA User Authentication Protocol for Preventing Specific Web Attacks in Web Apps

��计算中基于可转换代理签密的可证安全的认证协议

Research and Implementation on a Single Sign-on System in Web Application Environment

A PKI-Based Authentication Approach for E-Business Systems

Web Services Single Sign-on Protocol and Formal Analysis on It

Protecting Web-Based Single Sign-on Protocols against Relying Party Impersonation Attacks through a Dedicated Bi-directional Authenticated Secure Channel.

An efficient dynamic ID based remote user authentication scheme using self-certified public keys for multi-server environment

PrivSSO: Practical Single-sign-on Authentication Against Subscription/Access Pattern Leakage

An Improved User Authentication With Key Agreement Scheme For Multi-Server Architecture Using Scpks

A Novel Smart Card and Dynamic ID Based Remote User Authentication Scheme for Multi-Server Environments.

SINGLE-SIGN-ON MODEL OF THE AUTHENTIC-NAME NETWORK SERVICES AND ITS IMPLEMENTATION

A lightweight dynamic pseudonym identity based authentication and key agreement protocol without verification tables for multi-server architecture

Analysis of single-signon system based on SAML artifact technology

The Solution of Security of Web Application Based on PKI/PMI

Secure Remote User Mutual Authentication Scheme with Key Agreement for Cloud Environment

An efficient and security dynamic identity based authentication protocol for multi-server architecture using smart cards

Improvement on SAML-based Single Sign-on Model