The course introduces the basic notions underlying the various aspects of digital identity management with a focus on a security-by-design approach complemented with the use of automated formal analysis techniques for security. First, it is explained why identity is the building block of any security strategy for current and future applications and services. Then, the various phases of the life cycle of digital identities are explained and the main security issues are highlighted. The interdependencies among the design and implementation choices performed in the various phases are also discussed. Finally, solutions for enrollment and authentication are described together with threat models and the most important mitigation techniques. During the various topics, the security goals and the security analysis problems are formalized so that automated analysis techniques based on constraint solving and model checking can be used to assist designers in the various phases of the development. Digital identity management solutions taken from the real world are considered to illustrate the various notions and techniques.
Period: July 12th – July 16th, 2021
Duration: 20 hours (5 half-days)
Location: online course (the link will be communicated to the registered students)
Schools: University of Trento - Mathematics Doctoral Programme, University of Genova - PhD Program in Security, Risk and Vulnerability
Assessment Method: small project or oral presentation of relevant literature
Syllabus
The course is divided into two parts. Part 1 introduces the basic notions underlying the various aspects of digital identity management; while Part 2 describes the methodology developed in our unit for the automated security analysis of identity management solutions.
Part 1: Introduction to Identity Management
-
Overview of the course
- Basics on Identity Management
- Digital identity lifecycle (enrollment, authentication, authorization)
- Assurance levels
- Passwordless authentication
- Multi-factor authentication
- Single-Sign On (SAML, OIDC)
- Focus on two Identity Management standards
- A standard for SSO and Access Delegation: OAuth 2.0/OIDC
- A standard for passwordless authentication: FIDO2
- Security issues of SSO protocols at design and implementation level (security-by-design examples, wrong implementation choices)
- Digital identity solutions for legal provisioning (eIDAS, SPID, CIE 3.0, PSD2)
- Digital identity solutions for (legal) contract signing (electronic signatures, attribute provisioning)
- Distributed identity (self-sovereign identity - DID)
Part 2: Our methodology and tools
-
Our methodology for the design, development, and maintenance of IdM solutions
-
Use case scenarios level (MuFASA - a tool for high-level specification and analysis of multi-factor authentication)
-
Cryptographic protocol level - part 1
-
Cryptographic protocol level - part 2 (SATMC - a SAT-based Model-Checker for security protocols)
-
Implementations level - part 1 (MicroID Gym - an identity management workout with container-based microservices)
-
Implementations level - part 2 (TLSAssistant - a tool for the analysis of TLS configuration with a report system that suggests appropriate mitigations)
Related Publications
-
Andrea Bisegna, Roberto Carbone, Giulio Pellizzari, Silvio Ranise
Micro-Id-Gym: a Flexible Tool for Pentesting Identity Management Protocols in the Wild and in the Laboratory
In: 3rd International Workshop on Emerging Technologies for Authorization and Authentication (ETAA2020) (DOI) -
Roberto Carbone, Silvio Ranise, Giada Sciarretta, Luca Viganò
Formal Analysis of Mobile Multi-Factor Authentication with Single Sign-On Login
In: ACM Transactions on Privacy and Security (TOPS) (DOI, complementary material, news) -
Marco Pernpruner, Roberto Carbone, Silvio Ranise, Giada Sciarretta
The Good, the Bad and the (Not So) Ugly of Out-Of-Band Authentication with eID Cards and Push Notifications: Design, Formal and Risk Analysis
In: Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy (CODASPY 2020) (DOI, complementary material, news) -
Federico Sinigaglia, Roberto Carbone, Gabriele Costa, Silvio Ranise
MuFASA: A Tool for High-level Specification and Analysis of Multi-factor Authentication Protocols
In: Emerging Technologies for Authorization and Authentication (ETAA 2019) (DOI, complementary material, news)
