{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,10]],"date-time":"2026-03-10T20:35:15Z","timestamp":1773174915504,"version":"3.50.1"},"reference-count":68,"publisher":"Wiley","license":[{"start":{"date-parts":[[2022,1,22]],"date-time":"2022-01-22T00:00:00Z","timestamp":1642809600000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Johannes Kepler Open Access Publishing Fund"},{"name":"LIT Secure and Correct Systems Lab"},{"name":"Austrian Federal Ministry for Digital and Economic Affairs"},{"DOI":"10.13039\/100010132","name":"National Foundation for Research, Technology, and Development","doi-asserted-by":"crossref","id":[{"id":"10.13039\/100010132","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100006012","name":"Christian Doppler Research Association","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100006012","id-type":"DOI","asserted-by":"crossref"}]},{"name":"3 Banken IT GmbH, ekey biometric systems GmbH"},{"DOI":"10.13039\/100018294","name":"Kepler Universit\u00e4tsklinikum GmbH","doi-asserted-by":"crossref","id":[{"id":"10.13039\/100018294","id-type":"DOI","asserted-by":"crossref"}]},{"name":"NXP Semiconductors Austria GmbH and Co KG, \u00d6sterreichische Staatsdruckerei GmbH"},{"name":"State of Upper Austria"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Security and Communication Networks"],"published-print":{"date-parts":[[2022,1,22]]},"abstract":"<jats:p>In current single sign-on authentication schemes on the web, users are required to interact with identity providers securely to set up authentication data during a registration phase and receive a token (credential) for future access to services and applications. This type of interaction can make authentication schemes challenging in terms of security and availability. From a security perspective, a main threat is theft of authentication reference data stored with identity providers. An adversary could easily abuse such data to mount an offline dictionary attack for obtaining the underlying password or biometric. From a privacy perspective, identity providers are able to track user activity and control sensitive user data. In terms of availability, users rely on trusted third-party servers that need to be available during authentication. We propose a novel decentralized privacy-preserving single sign-on scheme through the Decentralized Anonymous Multi-Factor Authentication (DAMFA), a new authentication scheme where identity providers no longer require sensitive user data and can no longer track individual user activity. Moreover, our protocol eliminates dependence on an always-on identity provider during user authentication, allowing service providers to authenticate users at any time without interacting with the identity provider. Our approach builds on threshold oblivious pseudorandom functions (TOPRF) to improve resistance against offline attacks and uses a distributed transaction ledger to improve availability. We prove the security of DAMFA in the universal composibility (UC) model by defining a UC definition (ideal functionality) for DAMFA and formally proving the security of our scheme via ideal-real simulation. Finally, we demonstrate the practicability of our proposed scheme through a prototype implementation.<\/jats:p>","DOI":"10.1155\/2022\/9983995","type":"journal-article","created":{"date-parts":[[2022,1,23]],"date-time":"2022-01-23T01:05:06Z","timestamp":1642899906000},"page":"1-18","source":"Crossref","is-referenced-by-count":6,"title":["Decentralized, Privacy-Preserving, Single Sign-On"],"prefix":"10.1155","volume":"2022","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1691-5291","authenticated-orcid":true,"given":"Omid","family":"Mir","sequence":"first","affiliation":[{"name":"Johannes Kepler University Linz, LIT Secure and Correct Systems Lab, Linz, Austria"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4675-0539","authenticated-orcid":true,"given":"Michael","family":"Roland","sequence":"additional","affiliation":[{"name":"Johannes Kepler University Linz, Institute of Networks and Security, Linz, Austria"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1566-4646","authenticated-orcid":true,"given":"Ren\u00e9","family":"Mayrhofer","sequence":"additional","affiliation":[{"name":"Johannes Kepler University Linz, Institute of Networks and Security, Linz, Austria"}]}],"member":"311","reference":[{"key":"1","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45539-6_11"},{"key":"2","article-title":"Over 560 million passwords discovered in anonymous online database (2017)","author":"D. Cameron","year":"2017"},{"key":"3","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2017.2721359"},{"key":"4","article-title":"Yahoo says 1 billion user accounts were hacked","author":"V. Goel","year":"2016"},{"key":"5","article-title":"Year of mega breaches & identity theft: findings from the breach level index","author":"Gemalto","year":"2014"},{"key":"6","article-title":"LinkedIn confirms account passwords hacked","author":"I. Paul","year":"2012"},{"key":"7","doi-asserted-by":"publisher","DOI":"10.3390\/cryptography2010001"},{"key":"8","doi-asserted-by":"publisher","DOI":"10.1145\/3230833.3232815"},{"key":"9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-76581-5_15"},{"key":"10","article-title":"Frictionless authentication system: security & privacy analysis and potential solutions","author":"M. A. Mustafa","year":"2018"},{"key":"11","article-title":"Frictionless authentication systems: emerging trends, Research challenges and opportunities","author":"V. Rimmer","year":"2018"},{"key":"12","doi-asserted-by":"publisher","DOI":"10.1007\/11596219_20"},{"key":"13","doi-asserted-by":"publisher","DOI":"10.29012\/jpc.v2i2.590"},{"key":"14","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-89754-5_16"},{"key":"15","doi-asserted-by":"publisher","DOI":"10.1587\/transfun.e93.a.102"},{"key":"16","first-page":"11","article-title":"Openid 2.0: a platform for user-centric identity management","author":"D. Recordon"},{"key":"17","doi-asserted-by":"publisher","DOI":"10.1109\/icc.2018.8422732"},{"key":"18","article-title":"The oauth 2.0 authorization framework: bearer token usage","author":"D. Hardt","year":"2012"},{"key":"19","article-title":"SAML toolkits","author":"OneLogin Inc","year":"2019"},{"key":"20","first-page":"2042","article-title":"Pasta: password-based threshold authentication","author":"S. Agrawal"},{"key":"21","article-title":"The identity crisis. security, privacy and usability issues in identity management","author":"G. Alp\u00e1r","year":"2011"},{"key":"22","doi-asserted-by":"publisher","DOI":"10.1109\/csf.2017.20"},{"key":"23","doi-asserted-by":"publisher","DOI":"10.1145\/3384943.3409417"},{"key":"24","doi-asserted-by":"crossref","article-title":"Encrypted key exchange: password-based protocols SecureAgainst dictionary attacks","author":"S. M. Bellovin","DOI":"10.1109\/RISP.1992.213269"},{"key":"25","first-page":"244","article-title":"A password-based protocol secure against dictionary attacks and password file compromise","author":"Augmented Encrypted Key Exchange"},{"key":"26","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45539-6_12"},{"key":"27","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-006-0233-z"},{"key":"28","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-39200-9_33"},{"key":"29","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866365"},{"key":"30","first-page":"833","article-title":"Verifier-based password-authenticated key exchange: new models and constructions","volume":"2013","author":"F. Benhamouda","year":"2013","journal-title":"IACR Cryptology ePrint Archive"},{"key":"31","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23167"},{"key":"32","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-31517-1_15"},{"key":"33","doi-asserted-by":"publisher","DOI":"10.1007\/s10916-015-0265-8"},{"key":"34","doi-asserted-by":"publisher","DOI":"10.1145\/2897845.2897880"},{"key":"35","doi-asserted-by":"publisher","DOI":"10.1109\/jsyst.2014.2301517"},{"key":"36","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2013.2297110"},{"key":"37","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-68914-0_17"},{"key":"38","doi-asserted-by":"publisher","DOI":"10.1007\/s11277-015-2538-4"},{"key":"39","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-14054-4_12"},{"key":"40","article-title":"Efficient multi-factor authenticated key exchange scheme for mobile communications","volume":"1","author":"R. Zhang","year":"2017","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"41","first-page":"1242","article-title":"Targeted online password guessing: an underestimated threat","author":"D. Wang"},{"issue":"4","key":"42","doi-asserted-by":"crossref","first-page":"428","DOI":"10.1109\/TDSC.2014.2355850","article-title":"Anonymous two-factor authentication in distributed systems: certain goals are beyond attainment","volume":"12","author":"D. Wang","year":"2014","journal-title":"IEEE Transactions on Dependable and Secure Computing"},{"key":"43","doi-asserted-by":"publisher","DOI":"10.1109\/tce.2014.6780922"},{"key":"44","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978354"},{"key":"45","article-title":"El passo: privacy-preserving, asynchronous single sign-on","author":"Z. Zhang","year":"2020"},{"key":"46","first-page":"1","article-title":"Nextleap: decentralizing identity with privacy for secure messaging","author":"H. Halpin"},{"key":"47","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-29485-8_7"},{"key":"48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-00457-5_34"},{"key":"49","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-61204-1_3"},{"key":"50","doi-asserted-by":"publisher","DOI":"10.1145\/359168.359176"},{"key":"51","doi-asserted-by":"publisher","DOI":"10.1109\/sp.2014.36"},{"key":"52","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23253"},{"key":"53","volume-title":"A Decentralized Public Key Infrastructure with Identity Retention","author":"C. Fromknecht","year":"2014"},{"key":"54","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.05.009"},{"key":"55","first-page":"239","article-title":"Efficient identification and signatures for smart cards","author":"C.-P. Schnorr"},{"key":"56","first-page":"186","article-title":"How to prove yourself: practical solutions to identification and signature problems","author":"A. Fiat"},{"key":"57","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-00468-1_27"},{"key":"58","first-page":"129","article-title":"Non-interactive and information-theoretic secure verifiable secret sharing","author":"T. P. Pedersen"},{"key":"59","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-48910-x_21"},{"key":"60","doi-asserted-by":"publisher","DOI":"10.1007\/11426639_24"},{"key":"61","first-page":"65","article-title":"Multi-protocol uc and its use for building modular and efficient protocols","volume":"2019","author":"J. Camenisch","year":"2019","journal-title":"IACR Cryptol. ePrint Arch"},{"key":"62","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2004.04.011"},{"key":"63","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660328"},{"key":"64","volume-title":"Namecoind, Sourcecode of the Namecoin-Client Reference Implementation","author":"N. team","year":"2016"},{"key":"65","doi-asserted-by":"publisher","DOI":"10.1145\/3230833.3234517"},{"key":"66","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-30574-3_19"},{"key":"67","doi-asserted-by":"crossref","first-page":"174","DOI":"10.1007\/3-540-48658-5_19","article-title":"Proofs of partial knowledge and simplified design of witness hiding protocols","volume-title":"Advances in Cryptology \u2013 CRYPTO \u201994, ser. LNCS","author":"R. Cramer","year":"1994"},{"key":"68","article-title":"Irma: practical, decentralized and privacy-friendly identity management using smartphones","volume":"2017","author":"G. Alp\u00e1r","year":"2017","journal-title":"HotPETs"}],"container-title":["Security and Communication Networks"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2022\/9983995.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2022\/9983995.xml","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/downloads.hindawi.com\/journals\/scn\/2022\/9983995.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,1,23]],"date-time":"2022-01-23T01:05:28Z","timestamp":1642899928000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.hindawi.com\/journals\/scn\/2022\/9983995\/"}},"subtitle":[],"editor":[{"given":"David","family":"Meghias","sequence":"additional","affiliation":[]}],"short-title":[],"issued":{"date-parts":[[2022,1,22]]},"references-count":68,"alternative-id":["9983995","9983995"],"URL":"https:\/\/doi.org\/10.1155\/2022\/9983995","relation":{},"ISSN":["1939-0122","1939-0114"],"issn-type":[{"value":"1939-0122","type":"electronic"},{"value":"1939-0114","type":"print"}],"subject":[],"published":{"date-parts":[[2022,1,22]]}}}