OrionLink: Privacy-enhancing SSO with oblivious identity brokers
Original title: OrionLink: Single Sign-On with Oblivious Identity Brokers
OrionLink generates unlinkable pseudonyms and encrypted channels to shield user data from third-party SSO brokers.
The paper introduces OrionLink, a privacy-preserving SSO pipeline for federated authentication. It mitigates broker risks through anonymous pseudonym derivation that prevents cross-service tracking and an anonymous key exchange protocol for end-to-end encryption. The design remains compatible with existing brokered architectures and includes deployability-preserving features. A prototype was implemented and evaluated, demonstrating substantial security improvements with acceptable performance overhead.
Unconfirmed: Security and privacy claims rely on prototype evaluation
- Anonymous pseudonym derivation prevents user tracking
- Anonymous key exchange protects data from broker visibility
- Compatible with existing SSO broker setups
- Prototype shows practical security gains
- No performance degradation beyond acceptable levels
From the original article
1 min read at arxiv.orgSingle Sign-On (SSO) is a federated authentication mechanism that improves user experience by enabling access to multiple services, or Relying Parties (RPs), through a single authentication at an Identity Provider (IdP).
By Yijia Fang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.