Network authentication using single sign-on: the challenge of aligning mental models

ABSTRACT

Healthcare organizations are struggling to meet industry best practices for information security as well as complying with regulatory requirements. Single sign-on technology is emerging as a leading technology for password authentication management and promises to improve security while curbing system maintenance costs. While the technology seems to be a simple viable solution for authentication, when placed in context, many socio-technical complexities emerge. One of these complexities is that of the mismatch between the users' mental models and the system model.

This study was a 15-month ethnographic field study that followed the implementation of a single sign-on system in a hospital environment. It resulted in the finding that the misaligned mental models caused difficulties not only for the user but for the system administrators. The findings also indicate that not only was the user's mental model of the technology inaccurate, but the presentation of the technology by the information technology group contributed to this misaligned understanding. The end result was dissatisfaction with the new technology for both end users and the system administrators.

In order to address the critical issue of mental model misalignment in the implementation of SSO technology, practitioners must first gain an understanding of the preexisting mental models had by the target users regarding authentication and then use this information to guide implementation of the new technology.

REFERENCES

• 1: The New Oxford American Dictionary. McKean, E. ed., Oxford University Press, 2005.
• 2: Webster's New Millennium Dictionary of English, Preview Edition. Kipfer, B. A. ed., Lexico Publishing Group, Long Beach, 2007.
• 3: Anne Adams , Martina Angela Sasse, Users are not the enemy, Communications of the ACM, v.42 n.12, p.40-46, Dec. 1999 [doi>10.1145/322796.322806]
• 4: Divyangi Anchan , Mahmoud Pegah, Regaining single sign-on taming the beast, Proceedings of the 31st annual ACM SIGUCCS conference on User services, p.166-171, September 21-24, 2003, San Antonio, TX, USA [doi>10.1145/947469.947514]
• 5: E. Bardram, The trouble with login: on usability and computer security in ubiquitous computing, Personal and Ubiquitous Computing, v.9 n.6, p.357-367, November 2005 [doi>10.1007/s00779-005-0347-6]
• 6: Christine L. Borgman, The user's mental model of an information retrieval system: an experiment on a prototype online catalog, International Journal of Human-Computer Studies, v.51 n.2, p.435-452, Aug. 1999 [doi>10.1006/ijhc.1985.0318]
• 7: Carroll, J and Olson, J. "Mental Models in Human-Computer Interaction" in Handbook of Human-Computer Interaction, M Helander (ed), Elsevier, 1988
• 8: Robert M. Fein , Gary M. Olson , Judith S. Olson, A mental model can help with learning to operate a complex device, INTERACT '93 and CHI '93 conference companion on Human factors in computing systems, p.157-158, April 24-29, 1993, Amsterdam, The Netherlands [doi>10.1145/259964.260170]
• 9: Blake Ives , Kenneth R. Walsh , Helmut Schneider, The domino effect of password reuse, Communications of the ACM, v.47 n.4, p.75-78, April 2004 [doi>10.1145/975817.975820]
• 10: Jøsang, A., J. Fabre, et al. Trust Requirements in Identity Management. Australasian Information Security Workshop, Newcastle, Australia, 2005.
• 11: McDaniel, S. What's Your Idea of a Mental Model. Boxes and Arrows.
• 12: Norman, D. The Design of Everyday Things. Doubleday/Currency, New York, 1988.
• 13: Norman, D. A. and Collyer, B. The design of everyday things. Basic Books New York, 2002.
• 14: Patton, M. Q. Qualitative evaluation and research methods.
• 15: Pellissier, S. V. Effective Authentication in a Medical Environment - Business Case Analysis. ATI IPT Technical Report 01-01. DAMD17-99-C-9001, Frederick, MD, USA, 2001.
• 16: Jenny Preece , Yvonne Rogers , Helen Sharp, Beyond Interaction Design: Beyond Human-Computer Interaction, John Wiley & Sons, Inc., New York, NY, 2001
• 17: Sasse, M. A. Eliciting and Describing Users' Models of Computer Systems Computer Science, University of Birmingham, Birmingham, UK, 1997.
• 18: Ben Shneiderman, Designing the user interface (2nd ed.): strategies for effective human-computer interaction, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1992
• 19: Gerrit C. van der Veer , Maria del Carmen Puerta Melguizo, Mental models, The human-computer interaction handbook: fundamentals, evolving technologies and emerging applications, L. Erlbaum Associates Inc., Hillsdale, NJ, 2002
• 20: Jeff Yan , Alan Blackwell , Ross Anderson , Alasdair Grant, Password Memorability and Security: Empirical Results, IEEE Security and Privacy, v.2 n.5, p.25-31, September 2004 [doi>10.1109/MSP.2004.81]

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.3 Group and Organization Interfaces

General Terms:
Design, Human Factors, Management, Security

Keywords:
SSO, human factors, management, mental models, security