Abstract:Author(s): Cao, Yinzhi; Shoshitaishvili, Yan; Borgolte, Kevin; Kruegel, Christopher; Vigna, Giovanni; Chen, Yan | Abstract: Web-based single sign-on describes a class of protocols where a user signs into a web site with the authentication provided as a service by a third party. In exchange for the increased complexity of the authentication procedure, SSO makes it convenient for users to authenticate themselves to many different web sites (relying parties), using just a single account at an identity provider such as Facebook or Google.Single sign-on (SSO) protocols, however, are not immune to vulnerabilities. Recent research introduced several attacks against existing SSO protocols, and further work showed that these problems are prevalent: 6.5% of the investigated relying parties were vulnerable to impersonation attacks, which can lead to account compromises and privacy breaches. Prior work used formal verification methods to identify vulnerabilities in SSO protocols or leveraged invariances of SSO interaction traces to identify logic flaws. No prior work, however, systematically studied the actual root cause of impersonation attacks against the relying party.In this paper, we systematically examine existing SSO protocols and determine the root cause of the aforementioned vulnerabilities: the design of the communication channel between the relying party and the identity provider, which, depending on the protocol and implementation, suffers from being a one-way communication protocol, or from a lack of authentication. We (a) systematically study the weakness responsible for the vulnerabilities in existing protocols that allow impersonation attacks against the relying party, (b) introduce a dedicated, authenticated, bi-directional, secure channel that does not suffer from those shortcomings, (c) formally verify the authentication property of this channel using a well-known cryptographic protocol verifier (ProVerif), and (d) evaluate the practicality of a prototype implementation of our protocol.Ultimately, to support a smooth and painless transition from existing SSO protocols, we introduce a proxy setup in which our channel can be used to secure existing SSO protocols from impersonation attacks. Furthermore, to demonstrate the flexibility of our approach, we design two different SSO protocols: an OAuth-like and an OpenID-like protocol.

Evaluation of Secure OpenID-Based RAAA User Authentication Protocol for Preventing Specific Web Attacks in Web Apps

An Inter-Domain Authentication Scheme For Pervasive Computing Environment

A Lightweight Three-Factor User Authentication Protocol for the Information Perception of IoT

A secure and efficient user authentication protocol for two-tiered wireless sensor networks

Cryptanalysis and Improvement of Park Et Al.'s Remote User Authentication Protocol

Study of Network Authentication Based on RADIUS Protocol

Protecting Web Single Sign-on against Relying Party Impersonation Attacks through a Bi-directional Secure Channel with Authentication

Pump Up Password Security! Evaluating and Enhancing Risk-Based Authentication on a Real-World Large-Scale Online Service

Protecting Web-Based Single Sign-on Protocols against Relying Party Impersonation Attacks through a Dedicated Bi-directional Authenticated Secure Channel.

Design and Analysis of a Secure Three Factor User Authentication Scheme Using Biometric and Smart Card

Do not trust me: Using malicious IdPs for analyzing and attacking Single Sign-On

SUAA: A Secure User Authentication Scheme with Anonymity for the Single & Multi-server Environments.

What's in Score for Website Users: A Data-driven Long-term Study on Risk-based Authentication Characteristics

Evaluation of Risk-based Re-Authentication Methods

Provably secure RSA-based remote user authentication protocol passwords

A Hybrid Dynamic Encryption Scheme for Multi-Factor Verification: A Novel Paradigm for Remote Authentication

Study on the Model and Algorithm of Internet Trusted Identity Authentication System.

An efficient dynamic ID based remote user authentication scheme using self-certified public keys for multi-server environment

The Web SSO Standard OpenID Connect: In-Depth Formal Security Analysis and Security Guidelines

Privacy Considerations for Risk-Based Authentication Systems

PSLAPS-IoD: A Provable Secure and Lightweight Authentication Protocol for Securing Internet-of-Drones (IoD) Environment