Trusted identity and session management using Secure Cookies

Joon S. Park, Harish S. Krishnan

Research output: Contribution to journalConference Articlepeer-review


The concept of federated identity management is increasingly coming to use in order to bring Service Providers closer to customers. Users are being provided an enriched experience while carrying out business on the Web at reduced overhead and improved customer service. The idea of maintaining a single profile and gaining access to multiple services has been accepted well by the customers. However, the benefits of breaking through just one set of credentials to gain access to multiple services has made the concept of Federated Identity Management of high interest to malicious users. In this paper, we analyze the structure of a generic Federated Identity Management System and explore the .NET Passport framework in depth. We explore the current security mechanisms adopted by the .NET Passport and identify potential security weaknesses. We then propose our new approaches to enhance the security services in .NET Passport by using Secure Cookies. Our approaches are transparent to and compatible with the current .NET Passport server. Finally, we prove the feasibility by implementing our ideas in a real system.

Original languageEnglish (US)
Pages (from-to)310-324
Number of pages15
JournalLecture Notes in Computer Science
StatePublished - 2005
Event19th Annual IFIP WG 11.3 Working Conference on Data and Applications Security - Storrs, CT, United States
Duration: Aug 7 2005Aug 10 2005


  • .NET Passport
  • Cookies
  • Identity Management

ASJC Scopus subject areas

  • Theoretical Computer Science
  • General Computer Science


Dive into the research topics of 'Trusted identity and session management using Secure Cookies'. Together they form a unique fingerprint.

Cite this