A Novel Distributed Authentication Framework for Single Sign-On Services

In this paper we present a novel single sign-on scheme known as secure distributed single sign-on (SeDSSO). SeDSSO provides secure fault-tolerant authentication using threshold key encryption with a distributed authentication service. The authentication service consists of n total authentication servers utilizing a (t, n) threshold encryption scheme, where t distinct server-signed messages are required to generate a message signed by the service. SeDSSO provides secure portable identities by defining a two-factor identity that uses both a username/password and a unique USB device. The combination of a distributed authentication service and two-factor identities allows SeDSSO to securely authenticate users in any environment.