Browser-based identity federation [Elektronische Ressource] / Thomas Groß

Thomas GroßBrowser-based Identity FederationDissertation zur Erlangung des Grades eines Doktor-Ingenieurs der Fakulta¨t fu¨r Elektrotechnik undInformationstechnik an der Ruhr-Universita¨t Bochum.Gutachter:Prof. Dr. Birgit PfitzmannProf. Dr. Ahmad-Reza SadeghiDekan:Prof. Dr. Georg SchmitzKomitee:Prof. Dr. York Tu¨chelmann, Prof. Dr. Jan Lunze, Prof. Dr. Christof Paar, Prof. Dr. Ahmad-RezaSadeghi, Prof. Dr. Birgit PfitzmannBochum, 2009AbstractGiven the increasing popularity of Web 2.0 applications, web-based three-party authentication getsmore and more important. Identity federation fulfills this requirement through standardized protocolsthat authenticate Web users across trust domains.This thesis considers the problem of secure authentication by browser-based identity federation.This special class of identity federation only uses a standard web browser as client and thereforeprovides a zero-footprint authentication. Instead of a traditional key exchange and subsequent channelestablishment, browser-based identity federation bootstraps a server-authenticated secure channel witha third-party credential to obtain mutual authentication. Thanks to this deviation from prevalent securityresearch, it represents an interesting research area. We will discuss the most important archetypesand standards of browser-based identity federation.