Authors:
Junki Yuasa
1
;
Taisho Sasada
1
;
2
;
Christophe Kiennert
3
;
Gregory Blanc
3
;
Yuzo Taenaka
1
and
Youki Kadobayashi
1
Affiliations:
1
Graduate School of Science and Technology, Nara Institute Science and Technology, Ikoma 630-0192, Japan
;
2
Research Fellow (PD) of the Japan Society for the Promotion of Science, Tokyo 102-0083, Japan
;
3
SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris, 91120 Palaiseau, France
Keyword(s):
Access Control, User Authenticity, Single Sign-On, OpenID Connect, FIDO, Session Hijacking.
Abstract:
In recent years, the adoption of Single Sign-On (SSO) has been progressing to reduce the burden of user account management in web services. In web services using OpenID Connect, a primary SSO protocol, the user is authenticated using an ID Token (IDT) issued by the identity provider. The Session Token (ST) generated after authentication is often used to authenticate subsequent requests. However, attackers can acquire victims’ IDT/ST through Cross-Site Scripting (XSS) or malicious browser extensions, enabling them to hijack sessions and impersonate victims. Related studies have proposed countermeasures against impersonation attacks using IDT/ST. Still, their effectiveness is limited against user-level malware (e.g., malicious browser extensions), making it impossible to prevent impersonation entirely. This study proposes OIPM (OpenID Connect Impersonation Prevention Mechanism) as a countermeasure to address the issue of impersonation using IDT/ST. Specifically, a unique private key is
generated during user registration using FIDO, a passwordless authentication technology. This private key’s signature is verified during authentication to prevent impersonation, and a temporary private key generated at authentication is used for subsequent request verification. Additionally, post-authentication high-confidentiality operations require user verification through FIDO-based gestures such as fingerprints to ensure security against user-level malware.
(More)