Single Sign On Technologies as PrivacyEnhancing TechnologiesBobby VellankiCS DepartmentYale UniversityDec 12, 2003Single Sign On Technologies as PrivacyEnhancing TechnologiesAbstract:Single Sign on Technologies have been a very important subject in current research. There have been a few technologies developed which provide the functionality of single sign on but most of them have many privacy concerns. There are two significanttechnologies that are currently in use, .NET Passport and Liberty Alliance. .Net Passport was created and controlled by Microsoft and it stores the data in a centralized database. Liberty Alliance is a consortium of 160 companies who came up with a specification for Single Sign On technology. Liberty Alliance stores the data in a distributed fashion.Introduction:Privacy is a very complicated word to understand because many people have different interpretations of it. Privacy should be understood as three distinct rights: a rightof autonomy, a right to seclusion and a right to property. (Camp, 2000) People believe that privacy is a given right and that they should not have to pay for it. It is very hard for people to achieve this definition of privacy in the Internet world because of the necessity for quick, automated data movement. If people want to utilize the services on the Internet, they need to provide Personal Identifying Information (PII). All online transactions need the user’s name, address, and credit card information. This data is usually stored and managed by the service provider, who has complete control of the data. The service provider may sell, rent or use the user’s sensitive information for theirprofit without the user being aware of it. The given information may be used in additionalways than what the user had originally been informed at the time of signing up.It is very tough for organizations to come up with universal guidelines for online privacy because many people have different interpretations of what privacy should be. Some national and international organizations such as OPA and OECD, respectively, haveset up guidelines for the collection and maintenance of data. OPA stands for Online Privacy Alliance and it is a U.S.-based organization which provides a general framework in which any U.S. company can operate. OECD is an international organization focusing on global economic cooperation and development. Some of OECD’s guidelines are:Collection Limitation – There should be limits to the collection of data and data should beobtained by lawful and fair means.Data Quality – Personal data collected should be relevant to the purpose for which they are used.Purpose Specification – Purpose of the use of data must be specified at the time of collection.Use Limitation – Personal data should not be disclosed or used in any manner that was not specified upon collection. (Varney, 7)Every time a user signs up at a new site, he has to fill out all of his PII and remember his username and password. Remembering multiple usernames and passwords can become very tedious. The user also needs to remember which credit card he used for a particular service provider. In order to avoid this hassle, Single Sign On technology has been created by a few organizations. These technologies have many advantages but they can also have a potential for malicious behavior.Single Sign On (SSO)Single Sign On (SSO) technology has been a very important topic in today’s research. Web users typically use many websites that require some personal information such as name, e-mail address, login ID and password. It becomes cumbersome for them to fill outall of their information for every new site they register for and remember all of their loginIDs and passwords. Because of the inconvenience of remembering passwords, it is very desirable for users to have an SSO system that allows you to sign in only once to browse multiple sites. The SSO technology is based on a single authentication at one site, which allows users to access the services of other sites. An SSO system would store all of the user information using some software and every site that the user has an account with will be authenticated using that software. The user will only have to login once to the firstsite he visits and the following sites he visits will be authenticated using the information from the first site. This type of a system can have many security problems such as authentication of the user, secure storage of the data, and the misuse of data by member sites. There are many organizations who are trying to deploy SSO technology that will provide convenience and security. Currently, there are two types of SSO technologies thatare in use, centralized and distributed data storage. In the centralized data storage, the provider manages all of the sensitive information and the data is stored in a centralized server. There is an advantage to keeping data centralized because the user only has to instill trust in one provider. This same reason is a disadvantage as well because this singleprovider has all of the user’s PII and the user is susceptible to malevolent behavior by theprovider. An example of a centralized data storage provider is Microsoft’s .NET Passport technology. In a decentralized data storage SSO, only the necessary data is stored at that particular site or on the local computer. Each site only stores user information that is necessary for the services it provides. For example, a website like Weather.com will only keep track of the user’s zip code and will be blind to the user’s other sensitive information such as name, address and SSN. The advantage to this method is that even if an attacker gets information from a site’s database, he only knows of the information at that site. He doesn’t get access to all of the users’ PII. An example of a distributed SSO is Liberty Alliance. Another type of SSO is where the sensitive information is stored in a local database. Personal information such as Name, credit card number, address, etc. can be stored on the user’s computer. This database is connected to a browser and every time a user starts a browser session, he allows the database to interact with the website. The usersets which sites he wants to logon automatically and what information he wants to releaseto each site. The data needs to be encrypted so that an attacker may not ascertain the user’s sensitive information. Examples of locally stored SSO are AccountLogon,