[Back]

S. Calzavara, R. Focardi, W. Khan, M. Tempesta:
"Provably Sound Browser-Based Enforcement of Web Session Integrity";
in: "2014 IEEE 27th Computer Security Foundations Symposium", IEEE Computer Society, 2014, ISBN: 978-1-4799-4290-9, 366 - 380.

Document Sections

I.
Introduction
II.
Session Integrity
III.
Enforcing Session Integrity Inff+
IV.
Enforcing Session Integrity in Sessint
V.
Conclusion

Authors
Figures
References
Citations
Keywords
Metrics
Abstract:
Enforcing protection at the browser side has recently become a popular approach for securing web authentication. Though interesting, existing attempts in the literature only address specific classes of attacks, and thus fall short of providing robust foundations to reason on web authentication security. In this paper we provide such foundations, by introducing a novel notion of web session integrity, which allows us to capture many existing attacks and spot some new ones. We then propose FF+, a security-enhanced model of a web browser that provides a full-fledged and provably sound enforcement of web session integrity. We leverage our theory to develop Sess Int, a prototype extension for Google Chrome implementing the security mechanisms formalized in FF+. Sess Int provides a level of security very close to FF+, while keeping an eye at usability and user experience.

http://dx.doi.org/10.1109/CSF.2014.33

https://publik.tuwien.ac.at/files/publik_279114.pdf