Authentication session migration

  • Authors:

  • Sanna Suoranta;Jani Heikkinen;Pekka Silvekoski

  • Affiliations:

  • School of Science and Technology, Aalto University, Espoo, Finland;School of Science and Technology, Aalto University, Espoo, Finland;School of Science and Technology, Aalto University, Espoo, Finland

  • Venue:
  • NordSec'10 Proceedings of the 15th Nordic conference on Information Security Technology for Applications
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

Consumers increasingly access services with different devices such as desktop workstations, notepad computers and mobile phones. When they want to switch to another device while using a service, they have to re-authenticate. If several services and authenticated sessions are open, switching between the devices becomes cumbersome. Single Sign-on (SSO) techniques help to log in to several services but re-authentication is still necessary after changing the device. This clearly violates the goal of seamless mobility that is the target of much recent research. In this paper, we propose and implement migration of authentication session between a desktop computer and a mobile device. The solution is based on transferring the authentication session cookies. We tested the session migration with the OpenID, Shibboleth and CAS single sign-on systems and show that when the authentication cookies are transferred, the service sessions continue seamlessly and do not require re-authentication. The migration requires changes on the client web browsers but they can be implemented as web browser extensions and only minimal configuration changes on server side are sometimes required. The results of our study show that the client-to-client authentication session migration enables easy switching between client devices in online services where the service state is kept in the cloud and the web browser is acting as the user interface.