Simplify Access with Single Sign-On: Enhancing Security and User Experience

1. Single Sign On Glen Dorton

2. The Problem • Users have to authenticate to multiple systems • User name and password is the most common authentication scheme • Users are required to remember multiple user names and passwords, one per system • Why is this a problem?

3. Solution: Single Sign On • Single sign on still employs user name and password as most common method • However, users only need to remember one user name and password to access all systems

4. Benefits • One sign on grants access to all resources • Users will be less likely to write down passwords and hide the paper under a keyboard • Administration of user accounts and access control is vastly simplified • Improved security through administration ease, better control of account management

5. Problems • Subject to standard password attacks • Once a password is compromised or an attacker can create an account, access to all resources allowed for that user is obtained • Central point of failure

6. Implementations • Scripting • Kerberos • Secure European System for Applications in a Multi-vendor Environment • Diskless workstations • Directory Services • Microsoft .NET Passport

7. Microsoft .NET Passport • Developed to provide single sign on solution to web based applications • Kids Passport Service

8. Microsoft .NET Passport • Registration • Stores credentials and personal information • Email address is user id • Human Interaction Protocol • Email validation

9. Microsoft .NET Passport • Authentication • Uses authentication ticket – “ticket granting cookie” • Subsequent sites may use same authentication ticket based on its age • Sign out of password accomplished by deleting cookies except if “sign me in automatically” is enabled

10. Problems with .NET Passport • Key management • Uses 3DES, keys generated randomly and must be distributed securely • Persistent cookies • Allow user to be ‘logged in’ all the time • Theft of cookies • Coding vulnerabilities

11. Passport Attacks • Phishing – attacker sets up fake merchant site and redirects to fake passport.com, user enters credentials • Man in the middle – attacker intercepts legitimate redirect to passport.com and redirects to his own fake passport.com • DNS attacks – passport relies on redirects to passport.com for authentication

12. Conclusion • Becoming more prevalent with directory services • Difficult to implement with systems that have proprietary authentication schemes • Will be more practical in the future

13. References • Passport risks: http://avirubin.com/passport.html • Opengroup: http://www.opengroup.org/security/sso/ • Microsoft .NET Passport Review Guide http://www.microsoft.com/net/services/passport/review_guide.asp