Formal Verification of OAuth 2.0 Using Alloy Framework

Pai, Suhas; Sharma, Yash; Kumar, Sunil; Pai, Radhika M.; Singh, Sanjay

doi:10.1109/csnt.2011.141

Cited by 75 publications

(40 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Pai et al [10] confirm a security issue described in the OAuth 2.0 Threat Model ([9] §4.1.1) using the Alloy framework [11]. Chari et al [12] analyse OAuth 2.0 in the Universal Composability Security framework [13], and show that OAuth 2.0 is secure if all communications links are SSL-protected.…”

Section: Background and Related Workmentioning

confidence: 88%

Security Issues in OAuth 2.0 SSO Implementations

Mitchell

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Many Chinese websites (relying parties) use OAuth 2.0 as the basis of a single sign-on service to ease password management for users. Many sites support five or more different OAuth 2.0 identity providers, giving users choice in their trust point. However, although OAuth 2.0 has been widely implemented (particularly in China), little attention has been paid to security in practice. In this paper we report on a detailed study of OAuth 2.0 implementation security for ten major identity providers and 60 relying parties, all based in China. This study reveals two critical vulnerabilities present in many implementations, both allowing an attacker to control a victim user's accounts at a relying party without knowing the user's account name or password. We provide simple, practical recommendations for identity providers and relying parties to enable them to mitigate these vulnerabilities. The vulnerabilities have been reported to the parties concerned.

show abstract

Section: Background and Related Workmentioning

confidence: 88%

Security Issues in OAuth 2.0 SSO Implementations

Mitchell

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…First, OpenID is vulnerable to cross-site request forgery (CSRF), which is one of the most common Web security threats [77]. OAuth, on the other hand, has been proven to be secure with regard to the protocol itself [78,79], but several severe security weaknesses have been found in specific implementations of OAuth [80,81], such as CSRF as with OpenID above [82]. The risk of an attacker fooling a user into entering their credentials into a fake website or following non-trustworthy links is known to increase with the use of OpenID, OAuth and similar solutions [18].…”

Section: Protocol Problemsmentioning

confidence: 99%

Web Authentication using Third-Parties in Untrusted Environments

Vapen

2016

Linköping Studies in Science and Technology. Dissertations

View full text Add to dashboard Cite

With the increasing personalization of the Web, many websites allow users to create their own personal accounts. This has resulted in Web users often having many accounts on different websites, to which they need to authenticate in order to gain access. Unfortunately, there are several security problems connected to the use and re-use of passwords, the most prevalent authentication method currently in use, including eavesdropping and replay attacks.Several alternative methods have been proposed to address these shortcomings, including the use of hardware authentication devices. However, these more secure authentication methods are often not adapted for mobile Web users who use different devices in different places and in untrusted environments, such as public Wi-Fi networks, to access their accounts.We have designed a method for comparing, evaluating and designing authentication solutions suitable for mobile users and untrusted environments. Our method leverages the fact that mobile users often bring their own cell phones, and also takes into account different levels of security adapted for different services on the Web.Another important trend in the authentication landscape is that an increasing number of websites use third-party authentication. This is a solution where users have an account on a single system, the identity provider, and this one account can then be used with multiple other websites. In addition to requiring fewer passwords, these services can also in some cases implement authentication with higher security than passwords can provide.How websites select their third-party identity providers has privacy and security implications for end users. To better understand the security and privacy risks with these services, we present a data collection methodology that we have used to identify and capture third-party authentication usage on the Web. We have also characterized the third-party authentication landscape based on our collected data, outlining which types of third-parties are used by which types of sites, and how usage differs across the world. Using a combination of large-scale crawling, longitudinal manual testing, and in-depth login tests, our characterization and analysis has also allowed us to discover interesting structural properties of the landscape, differences in the cross-site relationships, and how the use of third-party authentication is changing over time.Finally, we have also outlined what information is shared between websites in third-party authentication, defined risk classes based on shared data, and profiled privacy leakage risks associated with websites and their identity providers sharing data with each other. Our findings show how websites can strengthen the privacy of their users based on how these websites select and combine their third-parties and the data they allow to be shared. Populärvetenskaplig sammanfattningAllt fler människor tillbringar stora delar av sina liv på Internet för att arbeta, uträtta myndighetsärenden, sköta sin ekonomi och umgås med vänner...

show abstract

“…10 of [22]). Furthermore, threats related to injection attacks and the insufficient protection of credentials have also been investigated [12,4].…”

Section: Interoperability Security and Evolution Issuesmentioning

confidence: 99%

“…The use of formal specification and verification techniques is a major approach to discover flaws in protocols. [12] uses the specification language Alloy and a SAT solver to discover security counterexample. In [4], the authors use the π-calculus, the WebSpy library and the ProVerif checker to make explicit various attacks on the OAuth protocol.…”

Section: Related Workmentioning

confidence: 99%

Reference Monitors for Security and Interoperability in OAuth 2.0

Cherrueau¹,

Douence²,

Royer³

et al. 2014

Data Privacy Management and Autonomous Spontaneous Security

View full text Add to dashboard Cite

Abstract. OAuth 2.0 is a recent IETF standard devoted to providing authorization to clients requiring access to specific resources over HTTP. It was recently adopted by major internet players like Google, Facebook, and Microsoft. It has been pointed out that this framework is potentially subject to security issues, as well as difficulties concerning the interoperability between protocol participants and application evolution. As we show in this paper, there are indeed multiple reasons that make this protocol hard to implement and impede interoperability in the presence of different kinds of client. Our main contribution consists in a framework that harnesses a type-based policy language and aspect-based support for protocol adaptation through flexible reference monitors in order to handle security, interoperability and evolution issues of OAuth 2.0. We apply our framework in the context of three scenarios that make explicit variations in the protocol and show how to handle those issues.

show abstract

Formal Verification of OAuth 2.0 Using Alloy Framework

Cited by 75 publications

References 6 publications

Security Issues in OAuth 2.0 SSO Implementations

Security Issues in OAuth 2.0 SSO Implementations

Web Authentication using Third-Parties in Untrusted Environments

Reference Monitors for Security and Interoperability in OAuth 2.0

Contact Info

Product

Resources

About