A Novel Secure and Privacy-Preserving Model for OpenID Connect Based on Blockchain
OpenID Connect (OIDC) is one of the most widely used delegated authentication protocols in web and mobile applications providing a single sign-on experience. It allows third-party applications, called Relying Parties (RP), to securely request and receive information about authenticated sessions and...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2023-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/10172179/ |
| _version_ | 1797782845401333760 |
|---|---|
| author | Belfaik Yousra Sadqi Yassine Maleh Yassine Safi Said Tawalbeh Lo'ai Khaled Salah |
| author_facet | Belfaik Yousra Sadqi Yassine Maleh Yassine Safi Said Tawalbeh Lo'ai Khaled Salah |
| author_sort | Belfaik Yousra |
| collection | DOAJ |
| description | OpenID Connect (OIDC) is one of the most widely used delegated authentication protocols in web and mobile applications providing a single sign-on experience. It allows third-party applications, called Relying Parties (RP), to securely request and receive information about authenticated sessions and end-users from an identity provider. The OIDC specification defines several parameters, including the client_id, client_secret, authorization code, access token, id token, state, and redirect_uri, as keys to the protocol operation, with significant security and privacy implications. Therefore, securing these parameters is critical to prevent attackers from impersonating legitimate entities, gaining unauthorized access, having complete control over users’ accounts, and/or violating their privacy. To enhance OIDC security and preserve its users’ privacy, we propose a novel model for OIDC based on the Ethereum Blockchain and the non-fungible token (ERC721) standard. To prove the robustness and safety of the proposed system, we perform a detailed security analysis formally using the most widely accepted protocols security verification tools, AVISPA and Scyther, and informally by discussing various attacks. The analysis results show that the proposed system is resilient against well-known attacks. Furthermore, we evaluate the cost and performance of the proposed solution, confirming its affordability and assuring that our approach does not impact the user experience and performance of existing OIDC-based systems. Finally, we conduct a security and privacy comparative analysis with similar existing systems, proving the superiority and efficiency of our proposed Blockchain-based OIDC system. |
| first_indexed | 2024-03-13T00:17:42Z |
| format | Article |
| id | doaj.art-c2d2438854b040fabba4e2ff1b2483c2 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-03-13T00:17:42Z |
| publishDate | 2023-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-c2d2438854b040fabba4e2ff1b2483c22023-07-11T23:00:18ZengIEEEIEEE Access2169-35362023-01-0111676606767810.1109/ACCESS.2023.329214310172179A Novel Secure and Privacy-Preserving Model for OpenID Connect Based on BlockchainBelfaik Yousra0Sadqi Yassine1https://orcid.org/0000-0002-0772-9916Maleh Yassine2https://orcid.org/0000-0003-4704-5364Safi Said3Tawalbeh Lo'ai4https://orcid.org/0000-0002-2294-9829Khaled Salah5https://orcid.org/0000-0002-2310-2558Laboratory LIMATI, FPBM, Sultan Moulay Slimane University, Beni-Mellal, MoroccoLaboratory LIMATI, FPBM, Sultan Moulay Slimane University, Beni-Mellal, MoroccoLaboratory LISERT, ENSAK, Sultan Moulay Slimane University, Khouribga, MoroccoLaboratory LIMATI, FPBM, Sultan Moulay Slimane University, Beni-Mellal, MoroccoDepartment of Computer Engineering, Jordan University of Science and Technology, Irbid, JordanDepartment of Electrical Engineering and Computer Science, Khalifa University of Science and Technology, Abu Dhabi, United Arab EmiratesOpenID Connect (OIDC) is one of the most widely used delegated authentication protocols in web and mobile applications providing a single sign-on experience. It allows third-party applications, called Relying Parties (RP), to securely request and receive information about authenticated sessions and end-users from an identity provider. The OIDC specification defines several parameters, including the client_id, client_secret, authorization code, access token, id token, state, and redirect_uri, as keys to the protocol operation, with significant security and privacy implications. Therefore, securing these parameters is critical to prevent attackers from impersonating legitimate entities, gaining unauthorized access, having complete control over users’ accounts, and/or violating their privacy. To enhance OIDC security and preserve its users’ privacy, we propose a novel model for OIDC based on the Ethereum Blockchain and the non-fungible token (ERC721) standard. To prove the robustness and safety of the proposed system, we perform a detailed security analysis formally using the most widely accepted protocols security verification tools, AVISPA and Scyther, and informally by discussing various attacks. The analysis results show that the proposed system is resilient against well-known attacks. Furthermore, we evaluate the cost and performance of the proposed solution, confirming its affordability and assuring that our approach does not impact the user experience and performance of existing OIDC-based systems. Finally, we conduct a security and privacy comparative analysis with similar existing systems, proving the superiority and efficiency of our proposed Blockchain-based OIDC system.https://ieeexplore.ieee.org/document/10172179/AuthenticationblockchainOpenID connectprivacy-preservingsecurity |
| spellingShingle | Belfaik Yousra Sadqi Yassine Maleh Yassine Safi Said Tawalbeh Lo'ai Khaled Salah A Novel Secure and Privacy-Preserving Model for OpenID Connect Based on Blockchain IEEE Access Authentication blockchain OpenID connect privacy-preserving security |
| title | A Novel Secure and Privacy-Preserving Model for OpenID Connect Based on Blockchain |
| title_full | A Novel Secure and Privacy-Preserving Model for OpenID Connect Based on Blockchain |
| title_fullStr | A Novel Secure and Privacy-Preserving Model for OpenID Connect Based on Blockchain |
| title_full_unstemmed | A Novel Secure and Privacy-Preserving Model for OpenID Connect Based on Blockchain |
| title_short | A Novel Secure and Privacy-Preserving Model for OpenID Connect Based on Blockchain |
| title_sort | novel secure and privacy preserving model for openid connect based on blockchain |
| topic | Authentication blockchain OpenID connect privacy-preserving security |
| url | https://ieeexplore.ieee.org/document/10172179/ |
| work_keys_str_mv | AT belfaikyousra anovelsecureandprivacypreservingmodelforopenidconnectbasedonblockchain AT sadqiyassine anovelsecureandprivacypreservingmodelforopenidconnectbasedonblockchain AT malehyassine anovelsecureandprivacypreservingmodelforopenidconnectbasedonblockchain AT safisaid anovelsecureandprivacypreservingmodelforopenidconnectbasedonblockchain AT tawalbehloai anovelsecureandprivacypreservingmodelforopenidconnectbasedonblockchain AT khaledsalah anovelsecureandprivacypreservingmodelforopenidconnectbasedonblockchain AT belfaikyousra novelsecureandprivacypreservingmodelforopenidconnectbasedonblockchain AT sadqiyassine novelsecureandprivacypreservingmodelforopenidconnectbasedonblockchain AT malehyassine novelsecureandprivacypreservingmodelforopenidconnectbasedonblockchain AT safisaid novelsecureandprivacypreservingmodelforopenidconnectbasedonblockchain AT tawalbehloai novelsecureandprivacypreservingmodelforopenidconnectbasedonblockchain AT khaledsalah novelsecureandprivacypreservingmodelforopenidconnectbasedonblockchain |