Single sign-on (SSO) has become a standard for enterprise logins, offering several benefits, one of which is the reduction of security risks by centralizing control over access to important corporate systems. Essentially, SSO involves three main roles: The User, the Service Provider (SP), and the Identity Provider (IdP) that handles the authentication.
In a typical SSO flow, when a user tries to access a service, the SP directs the user to the IdP’s login page. Then, the IdP, upon identity verification, confirms to the SP that the user is who they say they are. Finally, the SP (after verifying the validity of the IdP and the user’s request with a SAML assertion) grants the user access to the service.
However, this process brings up a significant challenge for password managers like Dashlane. With SSO, the SP holds the key, which means the SP could potentially grant user data access to a person other than the user who has access to the SP. This goes against our zero-knowledge architecture, which is built on the principle that only the customer and no one else—not even us—should have access to their data.
Introducing the encryption service
To address the challenge posed by SSO, Dashlane originally introduced the Encryption Service (ES). Deployed by the customer on their own infrastructure, the ES acts as the Service Provider in the SSO flow described above. Its function is to validate the signed SAML assertion from the IdP and serve one part of the encryption key to the Dashlane Client. This, combined with the other part stored on Dashlane’s server, grants the user secure access to their data.
Implementing the ES to maintain our zero-knowledge integrity mitigates one set of challenges while introducing new ones. With this method, customers opting for SSO integration with Dashlane need to set up and maintain a backend component in their own infrastructure. This additional step can lead to confusion or frustration among users used to the simpler setups of other SaaS platforms. Additionally, upgrades and long-term maintenance can be a pain as well since a component developed by Dashlane is being run on customers' infrastructure.
Introducing the secure enclave
Secure enclaves, also called a "Trusted Execution Environment" (TEE), are highly secure machines physically isolated from the rest of the environment. In some ways, they are similar to Trusted Platform Modules (TPMs) that are used daily on consumer hardware, such as phones and PCs, for things like secure storage of cryptographic keys and biometric data. With secure enclaves, a software provider like Dashlane can operate infrastructure for its users or customers without having a way to actually access any of the data. These are perfect candidates to replace our encryption service while maintaining our zero-knowledge architecture. Specifically, Dashlane leverages AWS Nitro Enclaves. Built on top of EC2, Nitro enclaves are fully isolated machines, hardened, and highly constrained: Even AWS employees cannot access them, and they are not open to the outside internet. They use an EC2 "parent instance" to accept network traffic and pass it through a virtual socket to the Nitro Enclave itself. For our use case here, it means that we can have Nitro enclave instances running that have access to customers’ secret keys that neither Dashlane employees nor AWS employees can access.
Get more information on our security principles and architecture with our comprehensive white paper.
Impact on the customer experience
Leveraging secure enclaves has allowed us to streamline the experience of setting up SSO for our customers. Now, instead of having to manage resources in their own AWS or Azure environments, customers can rely on Dashlane's infrastructure while we ensure their data remains inaccessible to us. Dashlane is the first password manager to adopt this technology for SSO, enhancing the user experience in a number of ways:
- The customer no longer needs to have an AWS/Azure account for the encryption service
- No more issues with upgrading instances hosted by customers, as the infrastructure is managed by Dashlane
- The process of setting up SSO is much faster—more like any other SaaS app
With this technology, we have been able to significantly improve our user experience in both setup and maintenance while maintaining our strict security posture. We’ve also substantially reduced the amount of time it takes to create the SSO integration for a new customer.
What’s next?
At Dashlane, we take pride in being the first and only password manager to integrate confidential computing and cloud-secure enclaves into our offerings. This significantly simplifies the setup process and removes the maintenance burden placed on customers to support and update the encryption service infrastructure. We see a future in cloud computing and have already leveraged this technology to streamline user and group provisioning via SCIM.
Currently, we are developing a confidential SIEM integration to connect with Security Information and Event Management (SIEM) systems like Splunk. Our commitment is to continually enhance Dashlane's security and user experience, leveraging the latest in technology to serve our customers' evolving needs.
We use the power of confidential computing to make deploying and accessing Dashlane easy with a single SSO credential. Find out more here.
Sign up to receive news and updates about Dashlane
Thanks! You're subscribed. Be on the lookout for updates straight to your inbox.
