OIPM: Access Control Method to Prevent ID/Session Token Abuse on OpenID Connect

Junki Yuasa, Taisho Sasada, Taisho Sasada, Christophe Kiennert, Gregory Blanc, Yuzo Taenaka, Youki Kadobayashi

2024

Abstract

In recent years, the adoption of Single Sign-On (SSO) has been progressing to reduce the burden of user account management in web services. In web services using OpenID Connect, a primary SSO protocol, the user is authenticated using an ID Token (IDT) issued by the identity provider. The Session Token (ST) generated after authentication is often used to authenticate subsequent requests. However, attackers can acquire victims’ IDT/ST through Cross-Site Scripting (XSS) or malicious browser extensions, enabling them to hijack sessions and impersonate victims. Related studies have proposed countermeasures against impersonation attacks using IDT/ST. Still, their effectiveness is limited against user-level malware (e.g., malicious browser extensions), making it impossible to prevent impersonation entirely. This study proposes OIPM (OpenID Connect Impersonation Prevention Mechanism) as a countermeasure to address the issue of impersonation using IDT/ST. Specifically, a unique private key is generated during user registration using FIDO, a passwordless authentication technology. This private key’s signature is verified during authentication to prevent impersonation, and a temporary private key generated at authentication is used for subsequent request verification. Additionally, post-authentication high-confidentiality operations require user verification through FIDO-based gestures such as fingerprints to ensure security against user-level malware.

Paper Citation

in Harvard Style

Yuasa J., Sasada T., Kiennert C., Blanc G., Taenaka Y. and Kadobayashi Y. (2024). OIPM: Access Control Method to Prevent ID/Session Token Abuse on OpenID Connect. In Proceedings of the 21st International Conference on Security and Cryptography - Volume 1: SECRYPT; ISBN 978-989-758-709-2, SciTePress, pages 674-679. DOI: 10.5220/0012757900003767

in Bibtex Style

@conference{secrypt24,
author={Junki Yuasa and Taisho Sasada and Christophe Kiennert and Gregory Blanc and Yuzo Taenaka and Youki Kadobayashi},
title={OIPM: Access Control Method to Prevent ID/Session Token Abuse on OpenID Connect},
booktitle={Proceedings of the 21st International Conference on Security and Cryptography - Volume 1: SECRYPT},
year={2024},
pages={674-679},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0012757900003767},
isbn={978-989-758-709-2},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 21st International Conference on Security and Cryptography - Volume 1: SECRYPT
TI - OIPM: Access Control Method to Prevent ID/Session Token Abuse on OpenID Connect
SN - 978-989-758-709-2
AU - Yuasa J.
AU - Sasada T.
AU - Kiennert C.
AU - Blanc G.
AU - Taenaka Y.
AU - Kadobayashi Y.
PY - 2024
SP - 674
EP - 679
DO - 10.5220/0012757900003767
PB - SciTePress