Home > Research > Publications & Outputs > The Web SSO Standard OpenID Connect: In-depth F...

Research

Links

Text available via DOI:

View graph of relations

The Web SSO Standard OpenID Connect: In-depth Formal Security Analysis and Security Guidelines

Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSN › Conference contribution/Paper › peer-review

Published

Standard

The Web SSO Standard OpenID Connect: In-depth Formal Security Analysis and Security Guidelines. / Fett, Daniel; Küsters, Ralf; Schmitz, Guido.
2017 IEEE 30th Computer Security Foundations Symposium (CSF). IEEE, 2017.

Research output: Contribution in Book/Report/Proceedings - With ISBN/ISSN › Conference contribution/Paper › peer-review

Harvard

Fett, D, Küsters, R & Schmitz, G 2017, The Web SSO Standard OpenID Connect: In-depth Formal Security Analysis and Security Guidelines. in 2017 IEEE 30th Computer Security Foundations Symposium (CSF). IEEE. https://doi.org/10.1109/csf.2017.20

APA

Fett, D., Küsters, R., & Schmitz, G. (2017). The Web SSO Standard OpenID Connect: In-depth Formal Security Analysis and Security Guidelines. In 2017 IEEE 30th Computer Security Foundations Symposium (CSF) IEEE. https://doi.org/10.1109/csf.2017.20

Vancouver

Fett D, Küsters R, Schmitz G. The Web SSO Standard OpenID Connect: In-depth Formal Security Analysis and Security Guidelines. In 2017 IEEE 30th Computer Security Foundations Symposium (CSF). IEEE. 2017 Epub 2017 Aug 21. doi: 10.1109/csf.2017.20

Author

Fett, Daniel ; Küsters, Ralf ; Schmitz, Guido. / The Web SSO Standard OpenID Connect: In-depth Formal Security Analysis and Security Guidelines. 2017 IEEE 30th Computer Security Foundations Symposium (CSF). IEEE, 2017.

Bibtex

@inproceedings{6f347cfbc1904f0a8a7c6fb8c010ba7d,
title = "The Web SSO Standard OpenID Connect: In-depth Formal Security Analysis and Security Guidelines",
abstract = "Web-based single sign-on (SSO) services such as Google Sign-In and Log In with Paypal are based on the OpenID Connect protocol. This protocol enables so-called relying parties to delegate user authentication to so-called identity providers. OpenID Connect is one of the newest and most widely deployed single sign-on protocols on the web. Despite its importance, it has not received much attention from security researchers so far, and in particular, has not undergone any rigorous security analysis. In this paper, we carry out the first in-depth security analysis of OpenID Connect. To this end, we use a comprehensive generic model of the web to develop a detailed formal model of OpenID Connect. Based on this model, we then precisely formalize and prove central security properties for OpenID Connect, including authentication, authorization, and session integrity properties. In our modeling of OpenID Connect, we employ security measures in order to avoid attacks on OpenID Connect that have been discovered previously and new attack variants that we document for the first time in this paper. Based on these security measures, we propose security guidelines for implementors of OpenID Connect. Our formal analysis demonstrates that these guidelines are in fact effective and sufficient.",
author = "Daniel Fett and Ralf K{\"u}sters and Guido Schmitz",
year = "2017",
month = sep,
day = "28",
doi = "10.1109/csf.2017.20",
language = "English",
booktitle = "2017 IEEE 30th Computer Security Foundations Symposium (CSF)",
publisher = "IEEE",

}

RIS

TY - GEN

T1 - The Web SSO Standard OpenID Connect: In-depth Formal Security Analysis and Security Guidelines

AU - Fett, Daniel

AU - Küsters, Ralf

AU - Schmitz, Guido

PY - 2017/9/28

Y1 - 2017/9/28

N2 - Web-based single sign-on (SSO) services such as Google Sign-In and Log In with Paypal are based on the OpenID Connect protocol. This protocol enables so-called relying parties to delegate user authentication to so-called identity providers. OpenID Connect is one of the newest and most widely deployed single sign-on protocols on the web. Despite its importance, it has not received much attention from security researchers so far, and in particular, has not undergone any rigorous security analysis. In this paper, we carry out the first in-depth security analysis of OpenID Connect. To this end, we use a comprehensive generic model of the web to develop a detailed formal model of OpenID Connect. Based on this model, we then precisely formalize and prove central security properties for OpenID Connect, including authentication, authorization, and session integrity properties. In our modeling of OpenID Connect, we employ security measures in order to avoid attacks on OpenID Connect that have been discovered previously and new attack variants that we document for the first time in this paper. Based on these security measures, we propose security guidelines for implementors of OpenID Connect. Our formal analysis demonstrates that these guidelines are in fact effective and sufficient.

AB - Web-based single sign-on (SSO) services such as Google Sign-In and Log In with Paypal are based on the OpenID Connect protocol. This protocol enables so-called relying parties to delegate user authentication to so-called identity providers. OpenID Connect is one of the newest and most widely deployed single sign-on protocols on the web. Despite its importance, it has not received much attention from security researchers so far, and in particular, has not undergone any rigorous security analysis. In this paper, we carry out the first in-depth security analysis of OpenID Connect. To this end, we use a comprehensive generic model of the web to develop a detailed formal model of OpenID Connect. Based on this model, we then precisely formalize and prove central security properties for OpenID Connect, including authentication, authorization, and session integrity properties. In our modeling of OpenID Connect, we employ security measures in order to avoid attacks on OpenID Connect that have been discovered previously and new attack variants that we document for the first time in this paper. Based on these security measures, we propose security guidelines for implementors of OpenID Connect. Our formal analysis demonstrates that these guidelines are in fact effective and sufficient.

U2 - 10.1109/csf.2017.20

DO - 10.1109/csf.2017.20

M3 - Conference contribution/Paper

BT - 2017 IEEE 30th Computer Security Foundations Symposium (CSF)

PB - IEEE

ER -