{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T16:46:04Z","timestamp":1762361164709,"version":"build-2065373602"},"reference-count":37,"publisher":"MDPI AG","issue":"4","license":[{"start":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T00:00:00Z","timestamp":1762300800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100004482","name":"Kuwait University","doi-asserted-by":"publisher","award":["RS02\/23"],"award-info":[{"award-number":["RS02\/23"]}],"id":[{"id":"10.13039\/501100004482","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Network"],"abstract":"<jats:p>Current federated identity management systems lack contextual awareness of workflows across independent systems, creating security gaps and workflow integrity challenges. This article details the design and implementation of Alohomora, a distributed workflow-aware authentication system that maintains cross-system workflow context through path-bound tokens. Alohomora complements existing identity providers such as OAuth and SAML by adding workflow orchestration capabilities while leveraging standard authentication protocols for initial user verification. The system introduces workflow graphs as a formal model for representing dependencies between functions across heterogeneous systems and employs a distributed caching architecture with collaboration groups for scalable session management. In a typical deployment scenario, an employee onboarding workflow across human resources services, account provisioning, and benefits systems forms a trust group where Alohomora enforces ordered step execution, validates prerequisite completion at each transition, and generates cryptographic completion assertions upon workflow finalization. Extensive performance evaluation under concurrent user requests demonstrates polynomial performance characteristics with superior scalability compared to centralized OAuth introspection. The results show that Alohomora maintains high throughput under heavy load while providing strong, secure access control through workflow path binding and distributed trust orchestration. The prototype implementation is available as open source.<\/jats:p>","DOI":"10.3390\/network5040051","type":"journal-article","created":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T16:09:47Z","timestamp":1762358987000},"page":"51","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Alohomora: Workflow-Aware Authentication and Authorization in Heterogeneous Systems"],"prefix":"10.3390","volume":"5","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-7738-5864","authenticated-orcid":false,"given":"Hussain M. J.","family":"Almohri","sequence":"first","affiliation":[{"name":"Department of Computer Science, Kuwait University, Kuwait City, Kuwait"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2025,11,5]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Hardt, D. (2012). The OAuth 2.0 Authorization Framework, Internet Engineering Task Force (IETF) RFC.","DOI":"10.17487\/rfc6749"},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Recordon, D., and Reed, D. (2006, January 3). OpenID 2.0: A platform for user-centric identity management. Proceedings of the Second ACM Workshop on Digital Identity Management, Alexandria, VA, USA.","DOI":"10.1145\/1179529.1179532"},{"key":"ref_3","unstructured":"Gro\u00df, T. (2003, January 8\u201312). Security analysis of the SAML single sign-on browser\/artifact profile. Proceedings of the 19th Annual Computer Security Applications Conference, Las Vegas, NV, USA."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1109\/MC.2015.33","article-title":"Attribute-based access control","volume":"48","author":"Hu","year":"2015","journal-title":"Computer"},{"key":"ref_5","unstructured":"Rowling, J.K. (2015). Harry Potter and the Philosopher\u2019s Stone, Bloomsbury Publishing."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Fett, D., K\u00fcsters, R., and Schmitz, G. (2017, January 21\u201325). The Web SSO Standard OpenID Connect: In-depth Formal Security Analysis and Security Guidelines. Proceedings of the 2017 IEEE 30th Computer Security Foundations Symposium (CSF), Santa Barbara, CA, USA.","DOI":"10.1109\/CSF.2017.20"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Fett, D., K\u00fcsters, R., and Schmitz, G. (2016, January 24\u201328). A Comprehensive Formal Security Analysis of OAuth 2.0. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, New York, NY, USA. CCS \u201916.","DOI":"10.1145\/2976749.2978385"},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Philippaerts, P., Preuveneers, D., and Joosen, W. (2022, January 26\u201328). OAuch: Exploring security compliance in the OAuth 2.0 ecosystem. Proceedings of the 25th International Symposium on Research in Attacks, Intrusions and Defenses, Limassol, Cyprus.","DOI":"10.1145\/3545948.3545955"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3699716","article-title":"Formal Security Analysis of the OpenID FAPI 2.0 Family of Protocols: Accompanying a Standardization Process","volume":"28","author":"Hosseyni","year":"2024","journal-title":"ACM Trans. Priv. Secur."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Neuman, C., Yu, T., Hartman, S., and Raeburn, K. (2025, October 30). The Kerberos Network Authentication Service (V5). Request for Comments (RFC 4120); RFC Editor, July 2005. Available online: https:\/\/www.rfc-editor.org\/rfc\/rfc4120.html.","DOI":"10.17487\/rfc4120"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"88","DOI":"10.1109\/4236.612229","article-title":"The Apache HTTP Server Project","volume":"1","author":"Fielding","year":"1997","journal-title":"IEEE Internet Comput."},{"key":"ref_12","unstructured":"Migeon, J.Y. (2008). The MIT Kerberos Administrators How-to Guide, Kerveros Constortium."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Mainka, C., Mladenov, V., Schwenk, J., and Wich, T. (2017, January 26\u201328). SoK: Single Sign-On Security\u2014 An Evaluation of OpenID Connect. Proceedings of the 2017 IEEE European Symposium on Security and Privacy (Euro S&P), Paris, France.","DOI":"10.1109\/EuroSP.2017.32"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Fett, D., Kusters, R., and Schmitz, G. (2015, January 12\u201316). SPRESSO: A Secure, Privacy-Respecting Single Sign-On System for the Web. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, New York, NY, USA. CCS \u201915.","DOI":"10.1145\/2810103.2813726"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Yang, F., and Manoharan, S. (2013, January 27\u201329). A security analysis of the OAuth protocol. Proceedings of the 2013 IEEE Pacific Rim Conference on Communications, Computers and Signal Processing (PACRIM), Victoria, BC, Canada.","DOI":"10.1109\/PACRIM.2013.6625487"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s40294-014-0005-9","article-title":"Cloud identity management security issues & solutions: A taxonomy","volume":"2","author":"Habiba","year":"2014","journal-title":"Complex Adapt. Syst. Model."},{"key":"ref_17","unstructured":"Hanchate, P. (2025, October 30). Role Based Provisioning from Oracle Fusion Application to IDCS. Available online: https:\/\/blogs.oracle.com\/cloud-infrastructure\/post\/role-based-provisioning-from-oracle-fusion-application-to-idcs-v2."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Armando, A., Carbone, R., Compagna, L., Cuellar, J., and Tobarra, L. (2008, January 27). Formal analysis of SAML 2.0 web browser single sign-on: Breaking the SAML-based single sign-on for Google apps. Proceedings of the 6th ACM Workshop on Formal Methods in Security Engineering (FMSE \u201908), Alexandria, VA, USA.","DOI":"10.1145\/1456396.1456397"},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Wang, R., Chen, S., and Wang, X. (2012, January 20\u201323). Signing Me onto Your Accounts through Facebook and Google: A Traffic-Guided Security Study of Commercially Deployed Single-Sign-On Web Services. Proceedings of the 2012 IEEE Symposium on Security and Privacy, San Francisco, CA, USA.","DOI":"10.1109\/SP.2012.30"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Lux, Z.A., Thatmann, D., Zickau, S., and Beierle, F. (2020, January 28\u201330). Distributed-Ledger-based Authentication with Decentralized Identifiers and Verifiable Credentials. Proceedings of the 2020 2nd Conference on Blockchain Research & Applications for Innovative Networks and Services (BRAINS), Paris, France.","DOI":"10.1109\/BRAINS49436.2020.9223292"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Patel, S., Sahoo, A., Mohanta, B.K., Panda, S.S., and Jena, D. (2019, January 30\u201331). DAuth: A decentralized web authentication system using Ethereum based blockchain. Proceedings of the 2019 International Conference on Vision Towards Emerging Trends in Communication and Networking (ViTECoN), Vellore, India.","DOI":"10.1109\/ViTECoN.2019.8899393"},{"key":"ref_22","unstructured":"Sunyaev, A. (2020). Distributed ledger technology. Internet Computing, Springer."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"167930","DOI":"10.1109\/ACCESS.2019.2953729","article-title":"A comparative analysis of distributed ledger technology platforms","volume":"7","author":"Chowdhury","year":"2019","journal-title":"IEEE Access"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Kambayashi, Y., Winiwarter, W., and Arikawa, M. (2002). Authorization Based on Evidence and Trust*. Data Warehousing and Knowledge Discovery, Springer.","DOI":"10.1007\/3-540-46145-0"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"107","DOI":"10.3390\/jcp2010008","article-title":"Distributed authentication and authorization models in cloud computing systems: A literature review","volume":"2","author":"Mohammad","year":"2022","journal-title":"J. Cybersecur. Priv."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Li, A.S., Safavi-Naini, R., and Fong, P.W.L. (2022, January 8\u201310). A Capability-based Distributed Authorization System to Enforce Context-aware Permission Sequences. Proceedings of the 27th ACM on Symposium on Access Control Models and Technologies (SACMAT \u201922), New York, NY, USA.","DOI":"10.1145\/3532105.3535014"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"de Almeida, M.G., and Canedo, E.D. (2022). Authentication and authorization in microservices architecture: A systematic literature review. Appl. Sci., 12.","DOI":"10.3390\/app12063023"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Garfinkel, T., Pfaff, B., Chow, J., Rosenblum, M., and Boneh, D. (2003, January 19\u201322). Terra: A virtual machine-based platform for trusted computing. Proceedings of the Nineteenth ACM Symposium on Operating Systems Principles, Bolton Landing, NY, USA.","DOI":"10.1145\/945461.945464"},{"key":"ref_29","unstructured":"Zeldovich, N., Kannan, H., Dalton, M., and Kozyrakis, C. (2008, January 8\u201310). Hardware enforcement of application security policies using tagged memory. Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation (OSDI\u201908), San Diego, CA, USA."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"1361","DOI":"10.1109\/TIFS.2017.2779436","article-title":"Misery Digraphs: Delaying Intrusion Attacks in Obscure Clouds","volume":"13","author":"Almohri","year":"2018","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3547350","article-title":"Dynamic System Diversification for Securing Cloud-based IoT Subnetworks","volume":"17","author":"Almohri","year":"2022","journal-title":"ACM Trans. Auton. Adapt. Syst."},{"key":"ref_32","unstructured":"Sirbu, M.A., and Chuang, J.I. (1997, January 10\u201311). Distributed authentication in Kerberos using public key cryptography. Proceedings of the SNDSS\u201997: Internet Society 1997 Symposium on Network and Distributed System Security, San Diego, CA, USA."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Bernstein, D.J. (2005, January 21\u201323). The Poly1305-AES message-authentication code. Proceedings of the 12th International Conference on Fast Software Encryption (FSE\u201905), Paris, France.","DOI":"10.1007\/11502760_3"},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"Garrison, W.C., Shull, A., Myers, S., and Lee, A.J. (2016, January 22\u201326). On the practicality of cryptographically enforcing dynamic access control policies in the cloud. Proceedings of the 2016 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA.","DOI":"10.1109\/SP.2016.54"},{"key":"ref_35","unstructured":"Tridgell, A., and Mackerras, P. (1996). TR-CS-96-05. The Rsync Algorithm, The Austrailian National University."},{"key":"ref_36","doi-asserted-by":"crossref","first-page":"343","DOI":"10.1109\/TNET.2005.845533","article-title":"Performance analysis of exponential backoff","volume":"13","author":"Kwak","year":"2005","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R., and Polk, W. (2025, October 30). RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile, 2008. Available online: https:\/\/www.rfc-editor.org\/rfc\/rfc5280.html.","DOI":"10.17487\/rfc5280"}],"container-title":["Network"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2673-8732\/5\/4\/51\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,5]],"date-time":"2025-11-05T16:41:17Z","timestamp":1762360877000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2673-8732\/5\/4\/51"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,5]]},"references-count":37,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2025,12]]}},"alternative-id":["network5040051"],"URL":"https:\/\/doi.org\/10.3390\/network5040051","relation":{},"ISSN":["2673-8732"],"issn-type":[{"value":"2673-8732","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,11,5]]}}}