Title: SSO password-based multi-server authentication protocol

Authors: Sandeep K. Sood; Anil K. Sarje; Kuldip Singh

Addresses: Department of Computer Science and Engineering, G.N.D.U Regional Campus, Gurdaspur, India. ' Department of Electronics and Computer Engineering, Indian Institute of Technology, Roorkee, India. ' Department of Electronics and Computer Engineering, Indian Institute of Technology, Roorkee, India

Abstract: User's password verification information stored on the server is main point of vulnerability and remains attractive target for attacker. Proposed protocol uses two-server architecture so that password verification information is distributed between two servers known as authentication server and control server. In this paper, we present single sign-on (SSO) password-based multi-server authentication protocol that issues the ticket to the user for a specific time period. Ticket issued for one authentication server can be used by the peer user for its authentication to another authentication server that is under the control of same control server. It distributes password verification information between the authentication server and the control server based on peer-to-peer (P2P) computing. Therefore, the proposed protocol is more resistant to dictionary attack as compared to existing single-server password based authentication protocols. The proposed protocol does not use public key that causes computation and communication burden in resource constraint environment.

Keywords: authentication protocols; single sign-on; SSO; two-server architecture; hash function; dictionary attacks; cookies; passwords; password verification; vulnerability; security; peer-to-peer computing; P2P computing.

DOI: 10.1504/IJCNDS.2012.047901

International Journal of Communication Networks and Distributed Systems, 2012 Vol.9 No.1/2, pp.161 - 180

Published online: 30 Aug 2014 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article