Client Authentication in Federations Using a Security Mode

Nowadays, identity-based client authentication (e.g., by username/ password) over SSL is the standard for user authentication on the Web. In particular, browser-based federated identity management (FIM) protocols prefer this technique to authenticate customers due to its user-convenience and lightweight access management. However, recent attacks known as phishing provide evidence that this authentication scheme is vulnerable to identity theft. As a consequence, FIM-protocols are likewise threatened by online-fraud. More dramatically, since FIM-protocols grant access to a federation of services with solely a single identity, a misuse affects many services equally. Therefore, we propose to define a secure mode (FIM-M), which downgrades malicious features of web browsers in the case of FIM and let us more concisely reason about the security of FIM-protocols.