Analiza i napadi u rješenjima za jedinstvenu autentikaciju korisnika

professional thesis

• Title (english): Analysis and attacks in single sign-on authentication solutions
• Author: Marko Ivandić
• Mentor: Marin Vuković (mentor)
• Committee member: Boris Vrdoljak (predsjednik povjerenstva)
• Committee member: Marin Vuković (član povjerenstva)
• Committee member: Krešimir Grgić (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; (Department of Telecommunications); Zagreb
• Defense date and country: 2022-07-19, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

Današnje vrijeme karakterizira ubrzani razvoj web i mobilnih aplikacija te ostalih web usluga. Ljudi se koriste Internet tehnologijama u mnogim aspektima života kao što su kupovina, učenje, upoznavanje, rad i drugo. Internet usluge su postale vrlo personalizirane te je za njihovu upotrebu uglavnom potrebno korištenje digitalnog identiteta. Kako bi se olakšala autorizacija korisnika usluga, osmišljena je paradigma jedinstvene prijave korisnika. Njenim uvođenjem je značajno porasla kvaliteta korisničkog iskustva, ali su se pojavili i sigurnosni izazovi vezani uz nju. U ovom radu se opisuju autorizacijski protokol OAuth 2.0 te autorizacijski protokol OIDC 1.0 kao glavni tehnološki koncepti kojima se ostvaruje realizacija jedinstvene prijave korisnika te se analiziraju ranjivosti protokola kao i napadi kojima se ugrožava sigurnost rada protokola. Protokol OIDC 1.0 je specificiran kao nadogradnja protokola OAuth 2.0 te se primarno koristi za potrebe autentikacije, dok se protokol OAuth 2.0 više koristi za potrebe autorizacije. Sigurnost protokola u najvećoj mjeri ovisi o načinu implementacije te alatima koji se koriste za njihovu realizaciju. Analizom napada razvijateljima se može ukazati na pogreške u implementaciji, a velik utjecaj na sigurnost ima i stalni razvoj web tehnologija što iziskuje i stalnu prilagodbu autorizacijskih protokola.

Abstract (english)

Modern time is characterized by the accelerated development of web and mobile applications as the other web services also. People use Internet technologies in many aspects of their life such as shopping, learning, dating, work and more. Internet services have become very personalized and their use generally requires the use of a digital identity. In order to facilitate the authorization of service users, a paradigm of single sign-on has been devised. Its introduction has significantly increased the quality of the user experience, but security challenges have also emerged. This paper describes the OAuth 2.0 authorization protocol and the OIDC 1.0 authorization protocol as the main technological concepts that support the implementation of a single user login, and also analyzes the vulnerabilities of the protocols and attacks that threaten the security of the named protocols. The OIDC 1.0 protocol is specified as an upgrade to the OAuth 2.0 protocol and is primarily used for authentication purposes, while the OAuth 2.0 protocol is more used for authorization purposes. The security of protocols largely depends on the method of implementation and the tools used to implement them. Analysis of attacks can point out errors in implementation to developers but the constant development of web technologies has a great impact on security, which requires constant adjustment of authorization protocols.

• Keywords: jedinstvena prijava korisnika; elektronički identitet; autorizacija; autentikacija; OAuth 2.0; OIDC 1.0; napad; Keycloak; token; autentikacijski tijek
• Keywords (english): single sign-on; digital identity; authorization; authentication; OAuth 2.0; OIDC 1.0; attack; Keycloak; token; authentication flow
• Language: croatian
• URN:NBN: urn:nbn:hr:168:892255
• Study programme: Title: Specialist study programme in information security; Study programme type: university; Study level: postgraduate specialist; Academic / professional title: Specijalist informacijske sigurnosti (Specijalist informacijske sigurnosti)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Access restricted to students and staff of home institution
• Created on: 2022-11-28 08:55:27