eID Online Authentication Network Threat Model, Attacks and Implications - Prof. Dr. Norbert Pohlmann

C. Dietrich, C. Rossow, N. Pohlmann:,
„eID Online Authentication Network Threat Model, Attacks and Implications”.
In Proceedings des 19. DFN Workshop 2012.

Since November 2010, the new electronic German ID cardprovides a facility to perform an online remote authentica-tion of the ID card holder. This method is called eID onlineauthentication and is defined in the Technical Guideline TR-03110 of the Federal Office for Information Security. Aspart of the eID online authentication, personal data can betransmitted from the electronic ID card to its counterpart,the eID server. All data transmitted between the eletronicID card and the eID server is supposed to be subject tosecure messaging.

We develop a threat model and address the feasibility of network-level man-in-the-middle attacks against the eID on-line authentication functionality of the new German electronic ID card. Furthermore, we perform a number of man-in-the-middle attacks against the most-widely used eCardAPI client implementation for the eID Service, called Ausweis-App. As personal data is increasingly valuable nowadays, weimpersonate an attacker trying to intercept personal datathat is transmitted as part of the eID online authentication.

Weitere Informationen zum Thema “Identifikation”:

Artikel:

„Identitäts-Check anhand sozialer Netzwerke – Das Social-Ident-Projekt“

“Wenn der Softbot menschliche Identität bestätigt – VideoIdent-Verfahren: Die Technik”

„Doubtless Identification and Privacy Pre-serving of User in Cloud Systems”

“Identity Provider zur Verifikation der vertrauenswürdigen digitalen Identität”

“Sichere mobile Identifizierung und Authentisierung”

„eID Online Authentication Network Threat Model, Attacks and Implications”

“Integration biometrischer Anwendungen in Sicherheitsinfrastrukturen”

Vorträge:
„Smart Authentifikation, Identifikation und digitale Signaturen als Grundlage zukünftiger Ökosysteme“

„Restrisikoanalyse Online-Authentisierung“

Vorlesung: „Identifikation und Authentifikation“

Glossareintrag: “Identifikation”

Studie für das BMI: “Restrisiken beim Einsatz der AusweisApp auf dem Bürger-PC zur Online Authentisierung mit Penetrations-Test”

Informationen über das Lehrbuch: „Cyber-Sicherheit“