Multiparty joint authentication: extending the semantics of single sign-on for grids

Abstract

This paper regards Single Sign-On as an accumulation of a series of two-party authentication, multiparty authentication and authorization. Such a comprehension brings new semantics for Single Sign-On in grids: authentication service and authorization service are separable and could communicate with each other through SAML assertions; Single Sign-On could support both two-party and multiparty authentication. Multiparty Joint Authentication (MJA) is designed to simplify multiparty authentication in some security context. This paper describes MJA with graph theory model and proposes its definition formally. The internal sequence diagram of MJA, possible assertion format of MJA, and MJA's interactions with other OGSA services are also illustrated to reveal a systematic view of this paradigm. © Springer-Verlag 2004.