A Privacy Risk Analysis of Identity Federation Topologies in Single Sign-On (SSO) Web Domain

Abstract

Single Sign-On (SSO) allows users to authenticate once and gain access to different web services. Thus, users do not need to provide their credential information again. Three main entities are involved in the SSO: the user, Identity Provider (IdP), and Service Provider (SP) or Relying Party (RP). These entities are linked through different relationships under various IdP-SP association models, mainly decentralized, explicit, federated, and bridge. Utilizing SSO under these models or their overlapping in a specific context raises various privacy risks for all entities involved. This paper identifies a set of privacy requirements and outlines the privacy risks for the involved entities in simple SSO scenario and topologies. With regard to topology, it is vital to consider a combination of different association models with respect to privacy requirements. To address the common privacy risks with a focus on user identities, attributes, and changing behavior, the present study proposes a fuzzification system to infer the user’s privacy risk during both the authentication and access processes under semi-honest and malicious models. Analyzing privacy risks is crucial in ensuring the web cloud environment’s security as it helps reduce the likelihood of attacks and identify potential vulnerabilities.