2017 IEEE 30th Computer Security Foundations Symposium (CSF)最新文献_第4页

The Web SSO Standard OpenID Connect: In-depth Formal Security Analysis and Security Guidelines Web单点登录标准OpenID连接:深入的正式安全分析和安全指南

2017 IEEE 30th Computer Security Foundations Symposium (CSF) Pub Date : 2017-04-27 DOI: 10.1109/CSF.2017.20

Daniel Fett, Ralf Küsters, G. Schmitz

{"title":"The Web SSO Standard OpenID Connect: In-depth Formal Security Analysis and Security Guidelines","authors":"Daniel Fett, Ralf Küsters, G. Schmitz","doi":"10.1109/CSF.2017.20","DOIUrl":"https://doi.org/10.1109/CSF.2017.20","url":null,"abstract":"Web-based single sign-on (SSO) services such as Google Sign-In and Log In with Paypal are based on the OpenID Connect protocol. This protocol enables so-called relying parties to delegate user authentication to so-called identity providers. OpenID Connect is one of the newest and most widely deployed single sign-on protocols on the web. Despite its importance, it has not received much attention from security researchers so far, and in particular, has not undergone any rigorous security analysis.In this paper, we carry out the first in-depth security analysis of OpenID Connect. To this end, we use a comprehensive generic model of the web to develop a detailed formal model of OpenID Connect. Based on this model, we then precisely formalize and prove central security properties for OpenID Connect, including authentication, authorization, and session integrity properties.In our modeling of OpenID Connect, we employ security measures in order to avoid attacks on OpenID Connect that have been discovered previously and new attack variants that we document for the first time in this paper. Based on these security measures, we propose security guidelines for implementors of OpenID Connect. Our formal analysis demonstrates that these guidelines are in fact effective and sufficient.","PeriodicalId":269696,"journal":{"name":"2017 IEEE 30th Computer Security Foundations Symposium (CSF)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-04-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115824144","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}