Unveiling Authentication Forgery in OpenID Connect under Web Frameworks: A Formal Analysis of CSRF-Based Attack Paths

JavaScript Object Notation (JSON) has evolved to the de-facto standard file format in the web used for application configuration, cross- and same-origin data exchange, as well as in Single Sign-On (SSO) protocols such as OpenID Connect. To protect integrity, authenticity, and confidentiality of sensitive data, JavaScript Object Signing and Encryption (JOSE) was created to apply cryptographic mechanisms directly in JSON messages.We investigate the security of JOSE and present different applicable attacks on several popular libraries. We introduce JOSEPH (JavaScript Object Signing and Encryption Pentesting Helper) -- our newly developed Burp Suite extension, which automatically performs security analysis on targeted applications. JOSEPH's automatic vulnerability detection ranges from executing simple signature exclusion or signature faking techniques, which neglect JSON message integrity, up to highly complex cryptographic Bleichenbacher attacks, breaking the confidentiality of encrypted JSON messages. We found severe vulnerabilities in six popular JOSE libraries. We responsibly disclosed all weaknesses to the developers and helped them to provide fixes.

Existing cloud-based Single Sign-on (SSO) model generally rely on token-based and secure API leveraging authentication standard models such as OAuth 2.0, FIDO 2, OpenID Connect. Even though these models enable secure and fast login experiences across websites and applications, most of them did not focus on the privacy of the SSO token generated for the authentication with many applications. In addition, they are incapable to support dynamic authorization binding of the multiple privileges of user in accessing multiple applications in the SSO token. In this paper, we propose a scheme called FPRESSO providing a fast and privacy-preserving SSO authentication system with anonymous authorization binding designed for multi-application environments hosted on cloud. We utilize random perturbation to safeguard the SSO token, which is structured as a JSON Web Token (JWT). Essentially, our approach stores tokens in cookies to efficiently manage access and facilitate SSO recovery. Additionally, we introduced the anonymous authorization binding protocol to bundle user roles and permissions of the user into the SSO token, enhancing the efficiency and agility of access control across applications. To deliver high scalability of the system in accommodating a large number of users in cloud environment, we introduced multi-threaded load balancing algorithm to dynamically handle both SSO token generation and verification requests, ensuring efficient distribution of load across multiple servers. We conducted experiments to assess the performance of our proposed system. The results show that the token generation and verification processes are more efficient than those in comparable studies. By implementing the new cookie strategy, latency decreased significantly compared to the method without cookies.

Web frameworks that allow developers to create applications based on design patterns such as the Model View Controller (MVC), provide by default a number of security checks. Nevertheless, by using specific constructs, developers may disable these checks thus re-introducing classic application vulnerabilities such as Cross-site Scripting (XSS) and Cross-Site Request Forgery (CSRF). Framework-specific elements including (1) the complex nature of these applications, (2) the different features that they involve (e.g. templates), and (3) the inheritance mechanisms that governs them, make the identification of such issues very difficult.To tackle this problem, we have developed Pythia, a scheme that analyzes applications based on the Django framework. To identify potentially dangerous data flows that can lead to XSS and CSRF defects, Pythia takes into account all the aforementioned elements and employs ideas coming from standard data-flow analysis and taint tracking schemes. To the best of our knowledge, Pythia is the first mechanism to consider framework-specific elements in its analysis. We have evaluated our scheme with positive results. Specifically, we used Pythia to examine five open-source applications that are currently in production and have thousands of users including an e-voting service, and a web-based translation management system. In four cases we have identified dangerous paths that in turn led to vulnerabilities. Notably, in many cases the paths involved the particular features of Django-based applications e.g. templates.

FORMAL FAILURE MODELS

Cloud services are viewed as a new paradigm of computing provision shifting to the network in the form of services. More and more firms are planning to adopt cloud services recently. Thus, understanding drivers and barriers of cloud adoption from firms’ point of view becomes very important. Though many qualitative studies have already addressed the adoption factors of cloud services, none of previous research has empirically examined these antecedents using large scale of data. Furthermore, a complete and integrated framework which can help firms evaluate whether they should step into cloud is lacked in the current literature. To bridge this gap, our study uses technology-organization-environment (TOE) framework and IT governance to develop a cloud service adoption model. Using telephone survey, we collected 200 public Taiwanese firms to empirically examine our proposed model. Our results show that cloud adoption is still at its initial stage (IaaS adoption rate=13%; PaaS adoption rate=5%; SaaS adoption rate=30%) and only factors in the technology context within the TOE framework would significantly influence cloud services adoption. The interesting finding is quite different from previous innovation diffusion studies which focus on mature stage of innovation diffusion. Our study affirms that in the early stage of innovation (cloud) adoption, historically important factors in organization and environment contexts have very limited impacts. We explain the phenomenon using the viewpoint of innovation diffusion curve: the current cloud adopters are innovators whose characteristics are adventurous, daring to attempt new things, and leading the crowd. These pioneers love to embrace just launched technologies, and are not easily affected by other people. Instead, they will affect general public later. As a result, we suggest cloud service providers focus more on promoting the benefits and alleviating the concerns of cloud services when marketing their cloud services at early stage.

In this paper we revisit the topic of dialogue grammars at the illocutionary force level and present a new approach to the formal modelling, evaluation and comparison of these models based on recursive transition networks. Through the use of appropriate tools such finite-state grammars can be formally analysed and validated against empirically collected corpora. To illustrate our approach we show: (a) the construction of human-human dialogue grammars on the basis of recently collected natural language dialogues in joint-task situations; and (b) the evaluation and comparison of these dialogue grammars using formal methods. This work provides a novel basis for developing and evaluating dialogue grammars as well as for engineering corpus-tailored dialogue managers which can be verified for adequacy.KeywordsDialogue SystemDialogue ModelDialogue ManagementDialogue StructureDialogue ParticipantThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Along with the widespread interest in cloud computing, there are still concerns that hinder the proliferation and the adoption of cloud services. One of the main concerns is data security in cloud storage environments. Numerous research problems belonging to cloud storage security have been studied intensively before. However, addressing the three dimensions of outsourced data security (i.e., confidentiality, availability, and integrity) as a cloud service is still a challenge in cloud storage. As there is always a tradeoff between maintaining security and obtaining efficiency, it is difficult but nevertheless essential to explore how to efficiently address security challenges over dynamic cloud data. This paper proposes an integrated security model for data storage in the cloud that provides authentication, access control, auditing and data management services. A strong authentication sub-system that is based on the traditional password and the user keystroke dynamics is presented. A dynamic access control system is proposed to ensure data confidentiality in cloud computing. A public auditing system is proposed to delegate the integrity verification of outsourced data in the cloud storage to a third party auditor while maintaining the data privacy. Experimental results demonstrate the effectiveness and efficiency of the proposed model.

Cloud computing is widely accepted nowadays by the industry as well as academic people as a new generation computing paradigm. Cloud computing has become popular because of its characteristic features like on-demand self-service, ubiquitous network access, resource pooling, rapid elasticity, metered service, etc. But, security challenges are still among the biggest obstacles when considering the adoption of cloud services. Most of the cases, it is seen that the merits of the could computing itself are the root causes of the security issues, and hence it is becoming difficult to tackle. Thus, lots of research activities are happening in the area of cloud computing to make cloud a secure place to keep your sensitive or critical data. This paper proposes a framework for preserving data security in a hybrid cloud environment using trusted multiple cloud service providers. A multi-cloud architecture is used to secure the data of the cloud customer, and the framework uses the trust factor for a dynamic and safe selection of the service providers.

Agriculture is facing and causing many challenges such as increased GHG emissions, food security issues, water scarcity. In addition, the growing world population creates an increasing demand for food production, which requires all countries of the world to join hands and cooperate to achieve food security. Agriculture data collection and analysis using emergent technologies such as IoT devices, cloud services, and big data is in the early development stages; however, it has been adopted and experimented with in many regions worldwide. These technologies demonstrated the ability to improve crop productivity and quality, minimize resource consumption, and reduce the impact on the environment. This study aims to establish the first phase in ongoing research on “AGRO Big Data: Toward Smart farming in the Kingdom of Bahrain” by designing a conceptual IoT-based framework that employs cloud services and big data tools. The kingdom of Bahrain is a small island that suffers from water scarcity and harsh soil conditions. It is considered a non-agriculture country and highly dependent on imported crops. The proposed framework will identify different agriculture stakeholders (users) in Bahrain and data domains such as soil sensors and weather stations. It will suggest using a mobile application (AgroBahrain) to collect and disseminate farm-related data along with the adoption of Google cloud services for the storage and transformation of agriculture big data. The framework is divided into two modules: 1- data collection and storage module, 2- data diffusion module. It concentrates on plants and crops data, excluding cattle and livestock. The framework is the first to build a conceptual process of collection, storage, and transformation of agriculture data in Bahrain. It is aligned with the kingdom's agriculture strategy developed early 2010. Moreover, the framework paves the road towards advancing the research in different agriculture-related fields, such as soil and crop quality.

Today’s cloud computing becomes more and more popular, and the cloud service also becomes a trend all over the world. Many kinds of cloud services have arisen, and they offer a more convenient and faster way to handle all works. When users start to rely on various services of cloud computing, they need to manage many accounts. It is inconvenient to remember a lot of accounts used for these cloud services. If users can just remember one account for these cloud services, it will become easier and simpler to use all service users needed. Here, we propose a scheme combing single sign-on and smart card to achieve logging into multiple cloud services securely and simply .

The identification and analysis of potential paths that an adversary may exploit to attack Cyber Physical Systems comprising sub-systems enables the comprehensive understanding of the attacks and the impact that may have to the overall system, thus facilitating the definition of appropriate countermeasures that will satisfy the pertinent security requirements. To this end, several attack modelling techniques can be employed, the attack graph being the most prevalent among them. Unfortunately, the discovery and analysis of all possible attack paths in an attack graph is not possible in systems even of a moderate size. In this work we propose a novel systematic method for discovering and analyzing attack paths in real-world scale interconnected Cyber Physical Systems. The method considers the criticality of each sub-system in discovering paths and the risk to the overall system that each path presents to analyze and prioritize paths. We illustrate the workings of the method by applying to the navigational Cyber Physical Systems of the Cyber-Enabled Ship to identify and analyze highly critical attack paths originating from the Automatic Identification System (AIS) and targeting the Autonomous Navigation System (ANS).

Single Sign-On (SSO) is an authentication mechanism in which a Cloud Service Consumer (CSC) needs to be authenticated only once while accessing various services from multiple service providers, or when accessing multiple services from the same service provider. In the case of Cloud Federation, the consumers can get services from various Cloud Service Providers (CSPs) who are members of the federation, and SSO can be used to verify the legitimate users without requiring them to get authenticated with each service provider separately. CloudSim is a popular tool used for simulating various cloud computing scenarios. As of now, the simulator lacks effective user authentication and authorization methods with it. In this paper, we discuss the design and implementation of SSO mechanism in the Cloud Federation scenario using the CloudSim toolkit. We have used the Fully Hashed Menezes-Qu-Vanstone (FHMQV) protocol for the key exchange and the Symmetric Key Encryption technique AES-128 for encrypting the identity tokens. We give the workflow model for the proposed approach of SSO in the Cloud Federation and also, the execution time taken in the simulation for various Single Sign-On scenarios where the number of SSO required varies are also shown.

necessity of formal methods education has developed from its increasing assimilation into systems development within industry. Organizations responsible for a wide range of applications have found it necessary to find an improved means of intellectual control over their complex system development and that formal methods can meet this need. To this end, the International Survey of Industrial Applications of Formal Methods concluded and recommended: The current educational base in the US is weak in teaching formal methods in the context of software engineering . . . There is a clear need for improved integration of formal methods techniques with other software engineering practices[2]There exists a number of articles in the current literature expressing the belief that the current educational program offered for a computer science degree does not stress the fundamental mathematical and engineering principles that should form the basis of software engineering[3,4,5,6]. theory learned in mathematics and science classes is applied in other engineering classes, but unfortunately has not been applied in software engineering. inability to apply logic in practical circumstances prevents the student from doing the systematic analysis necessary to solve practical problems.For these reasons, it is desirable to include the definition and application of a formal method into the undergraduate curriculum with the goal of increasing the complex problem solving skills of the software engineer. Formal analysis should be introduced early into the undergraduate curriculum to ensure substantial learning, use, and training in formal methods application.

In order to deliver centralized visibility for login activity, reduce identity proliferation and confusion, increase user adoption and security, reduce administrative costs, and support for entire identity management lifecycle in cloud, a new single sign-on solution is proposed in this paper. By introducing OAuth protocol combined with identity federation mechanism and identity mapping, the new single sign-on model can give the cloud user that has succeed through an identity authentication the permission to access other cloud services in a reasonable time period without entering the username and password repeatedly. Empirical results show that the solution will be used as an impactful measure in scenarios where frequent interactions among different cloud services and clouds that result significant impact across multiple security domains. The OAuth-based single sign-on solution can effectively solve the problems of complexity of identity management and cross-domain authentication in cloud environment and thus increased the security and improved the user’s efficiency.KeywordsCloud ServiceAuthentication SystemCloud UserAuthentication MechanismIdentity AuthenticationThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The Internet of Vehicles (IoV) is becoming an interesting topic among researchers and it has emerged as a rapidly advancing field within Vehicular Ad-hoc Networks, facilitating intelligent communication between vehicles and the cloud through the integration of Internet of Things (IoT) technologies. The IoV surroundings face serious challenges due to the highly interrelated nature of vehicles and infrastructure in certifying privacy and security. Traditional approaches to authentication lack the strength required to protect against developing fears, leaving systems vulnerable to attacks. This survey addresses the gap by employing formal analysis approaches to prove authentication protocols, targeting to reinforce safety and confidentiality in IoV systems. The IoV communication model consists of Vehicle-to-Vehicle, Vehicle-to-Infrastructure, Vehicle-to-Personal Devices, and Vehicle-to-Cloud. Smart automobiles are equipped with cameras, radars, on-board units, and sensors to help reduce the number of accidents by giving drivers or autonomous vehicles up-to-date information on roads, traffic signals, and other pertinent entities. As human lives are at risk, security and privacy in the IoV communication paradigm are critical and cannot neglected. Security and privacy breaches may cause accidents because the attacker can inject false information into the system as the communication channel is open and unsecured. The researchers proposed many authentication protocols to provide secure communication between IoV entities. Although surveys on IoV security and privacy issues deal with communication and computation costs, they lack formal analysis of the authentication protocols. This survey reviews the informal analysis and formal analysis methods used by various authentication protocols. Furthermore, the challenges and future work are also included in this survey.