Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

UPPRESSO: Untraceable and Unlinkable Privacy-PREserving Single Sign-On Services

Chengqian Guo, Jingqiang Lin, Quanwei Cai, Wei Wang, Wentian Zhu, Jiwu Jing, Qiongxiao Wang, Bin Zhao, Fengjun Li

TL;DR

UPPRESSO addresses privacy in SSO by preventing both IdP-based login tracing and RP-based identity linkage through an identity-transformation framework. It introduces ephemeral RP and user pseudo-identities, $PID_{RP}$ and $PID_U$, and a per-RP permanent account $Acct$, derived via $PID_U = [ID_U]\,PID_{RP}$ and $Acct = [t^{-1}]\,PID_U$, with $PID_{RP}=[t]\,ID_{RP}$ and $ID_{RP}=[r]G$. The protocol is integrated into OpenID Connect through browser-based scripts, preserving usability on commodity browsers while offering provable security against the defined adversaries under standard cryptographic assumptions like the hardness of the ECDLP and ECDDH. A full prototype on MITREid Connect demonstrates practical overheads, with average login times around 174 ms in a cloud setting and 421 ms remotely, indicating feasibility for real-world deployment. Overall, UPPRESSO provides a concrete path to privacy-preserving SSO that maintains compatibility with existing infrastructure and user workflows while delivering stronger privacy guarantees than prior approaches.

Abstract

Single sign-on (SSO) allows a user to maintain only the credential for an identity provider (IdP) to log into multiple relying parties (RPs). However, SSO introduces privacy threats, as (a) a curious IdP could track a user's all visits to RPs, and (b) colluding RPs could learn a user's online profile by linking her identities across these RPs. This paper presents a privacypreserving SSO scheme, called UPPRESSO, to protect an honest user's online profile against (a) an honest-but-curious IdP and (b) malicious RPs colluding with other users. UPPRESSO proposes an identity-transformation approach to generate untraceable ephemeral pseudo-identities for an RP and a user from which the target RP derives a permanent account for the user, while the transformations also provide unlinkability. This approach protects the identities of the user and the target RPs in a login flow, while working compatibly with widely-deployed SSO protocols and providing services accessed from a commercial-off-the-shelf browser without plug-ins or extensions. We built a prototype of UPPRESSO on top of MITREid Connect, an open-source SSO system. The extensive evaluations show that it fulfills the security and privacy requirements of SSO with reasonable overheads.

UPPRESSO: Untraceable and Unlinkable Privacy-PREserving Single Sign-On Services

TL;DR

UPPRESSO addresses privacy in SSO by preventing both IdP-based login tracing and RP-based identity linkage through an identity-transformation framework. It introduces ephemeral RP and user pseudo-identities, and , and a per-RP permanent account , derived via and , with and . The protocol is integrated into OpenID Connect through browser-based scripts, preserving usability on commodity browsers while offering provable security against the defined adversaries under standard cryptographic assumptions like the hardness of the ECDLP and ECDDH. A full prototype on MITREid Connect demonstrates practical overheads, with average login times around 174 ms in a cloud setting and 421 ms remotely, indicating feasibility for real-world deployment. Overall, UPPRESSO provides a concrete path to privacy-preserving SSO that maintains compatibility with existing infrastructure and user workflows while delivering stronger privacy guarantees than prior approaches.

Abstract

Single sign-on (SSO) allows a user to maintain only the credential for an identity provider (IdP) to log into multiple relying parties (RPs). However, SSO introduces privacy threats, as (a) a curious IdP could track a user's all visits to RPs, and (b) colluding RPs could learn a user's online profile by linking her identities across these RPs. This paper presents a privacypreserving SSO scheme, called UPPRESSO, to protect an honest user's online profile against (a) an honest-but-curious IdP and (b) malicious RPs colluding with other users. UPPRESSO proposes an identity-transformation approach to generate untraceable ephemeral pseudo-identities for an RP and a user from which the target RP derives a permanent account for the user, while the transformations also provide unlinkability. This approach protects the identities of the user and the target RPs in a login flow, while working compatibly with widely-deployed SSO protocols and providing services accessed from a commercial-off-the-shelf browser without plug-ins or extensions. We built a prototype of UPPRESSO on top of MITREid Connect, an open-source SSO system. The extensive evaluations show that it fulfills the security and privacy requirements of SSO with reasonable overheads.

Paper Structure

This paper contains 24 sections, 4 theorems, 6 equations, 6 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Background and Related Work
  3. OpenID Connect and SSO Services
  4. Privacy-Preserving SSO and Identity Federation
  5. The Identity-Transformation Approach
  6. Security Requirements for SSO Services
  7. Identity Transformation
  8. The Designs of UPPRESSO
  9. Threat Model
  10. Assumptions
  11. Identity-Transformation Algorithms
  12. The Designs Specific for Web Applications
  13. The UPPRESSO protocol
  14. Compatibility with OIDC
  15. Security and Privacy Analysis
  16. ...and 9 more sections

Key Result

Theorem 1

Given $u \in \mathbf{u}$ and $ID_{RP} \in \mathbb{ID}_{RP}$, from $TK$ binding $PID_{RP}=[t]ID_{RP}$ and $PID_U = [u]PID_{RP}$, any honest RP with ${ID_{RP'} \neq ID_{RP}}$ cannot derive $Acct = [u']ID_{RP'}$ where $u' \in \mathbf{u}$ and $ID_{RP'} \in \mathbb{ID}_{RP}$.

Figures (6)

  • Figure 1: The implicit SSO login flow of OIDC
  • Figure 2: Identity transformations in UPPRESSO
  • Figure 3: The SSO login flow of UPPRESSO
  • Figure 4: The PPT algorithm $\mathcal{D}^*_A$ constructed based on the account-collision game to solve the ECDLP.
  • Figure 5: The PPT algorithm $\mathcal{D}^*_R$ constructed based on the RP-based identity linkage game to solve the ECDDH problem.
  • ...and 1 more figures

Theorems & Definitions (4)

  • Theorem 1: RP Designation
  • Theorem 2: User Identification
  • Theorem 3: IdP Untraceability
  • Theorem 4: RP Unlinkability