Contributions to Proceedings:
S. Calzavara, R. Focardi, W. Khan, M. Tempesta:
"Provably Sound Browser-Based Enforcement of Web Session Integrity";
in: "2014 IEEE 27th Computer Security Foundations Symposium",
IEEE Computer Society,
Enforcing Session Integrity Inff+
Enforcing Session Integrity in Sessint
Enforcing protection at the browser side has recently become a popular approach for securing web authentication. Though interesting, existing attempts in the literature only address specific classes of attacks, and thus fall short of providing robust foundations to reason on web authentication security. In this paper we provide such foundations, by introducing a novel notion of web session integrity, which allows us to capture many existing attacks and spot some new ones. We then propose FF+, a security-enhanced model of a web browser that provides a full-fledged and provably sound enforcement of web session integrity. We leverage our theory to develop Sess Int, a prototype extension for Google Chrome implementing the security mechanisms formalized in FF+. Sess Int provides a level of security very close to FF+, while keeping an eye at usability and user experience.
"Official" electronic version of the publication (accessed through its Digital Object Identifier - DOI)
Electronic version of the publication:
Created from the Publication Database of the Vienna University of Technology.