Search

As data of COVID-19 patients is increasing, the new framework is required to secure the data collected from various Internet of Things (IoT) devices and predict the trend of disease to reduce its spreading. This article proposes a security and privacy-based lightweight framework called iFaaSBus, which uses the concept of IoT, Machine Learning (ML), and Function as a Service (FaaS) or serverless computing to diagnose the COVID-19 disease and manages resources automatically to enable dynamic scalability. iFaaSBus offers OAuth-2.0 Authorization protocol-based privacy and JSON Web Token & Transport Layer Socket (TLS) protocol-based security to secure the patient's health data. iFaaSBus outperforms in terms of response time compared to non-serverless computing while responding to up to 1100 concurrent requests. Further, the performance of various ML models is evaluated based on accuracy, precision, recall, F-score, and AUC values and the K-Nearest Neighbour model gives the highest accuracy rate of 97.51 %.

Smart City Anwendungen finden immer mehr Verwendung im Alltag von Menschen. Diese Anwendungen verwalten sensible Daten, die geschützt werden müssen. Aufgrund dieser Daten sind diese Anwendungen oft das Ziel von Cyber Security Angriffen mit der Absicht diese Daten zu stehlen oder modifizieren. Die Authentifizierungsmethoden dieser Anwendungen sind häufig das Ziel dieser Angriffe. In dieser Bachelorarbeit wird die Sicherheit der Authentifizierungsmethode einer Implementierung der IoT Plattform Thingsboard getestet. Thingsboard ist eine IoT Plattform, die bei Smart City Anwendungen beliebt ist. Die Authentifizierung erfolgt durch JSON Web Token (JWT). Diese Bachelorarbeit stellt sich folgende Forschungsfrage: Wie können die JWT als Authentifizierungsmethode in dieser Thingsboard Implementierung manipuliert werden? Diese Frage soll im Rahmen eines Penetrationstests beantwortet werden. Um den Umfang des Penetrationstests einzugrenzen, wurde zwei Subforschungsfrage. Eine dieser Subforschungsfragen beschäftigt sich mit der Ausnutzbarkeit der bekannten JWT Schwachstelle CVE-2015-9235. Bei dieser Schwachstelle wird der Signaturalgorithmus des JWT auf ''none'' gesetzt, wodurch die Authentifizierung umgangen wird. Bei der zweiten Subforschungsfrage geht es darum, ob der Signaturalgorithmus mit einer Brute Force Attacke geknackt werden kann. Die beiden Subforschungsfragen wurde im Rahmen dieses Penetrationstest verneint, was bedeutet, dass die Schwachstelle in der Thingsboard Implementierung nicht ausgenutzt werden konnte und der Signaturalgorithmus nicht mit den verwendeten Tools geknackt werden konnte. Weiters wurde im Rahmen dieses Penetrationstest durch das Experiment herausgefunden, dass die JWT der Thingsboard Implementierung mit den verwendeten Ansätzen und Tools nicht manipuliert werden können. Smart city applications are increasingly being used in people's daily lives. These applications manage sensitive data that must be protected. Due to the nature of this data, these applications are often targeted by cyber security attacks with the intent to steal or modify the data. The authentication methods of these applications are frequently the focus of these attacks. This bachelor's thesis focuses on testing the security of the authentication method in an implementation of the IoT platform Thingsboard. Thingsboard is a popular IoT platform used in smart city applications. Authentication in this implementation is done using JSON Web Tokens (JWT). This bachelor's thesis addresses the following research question: How can JWTs be manipulated as an authentication method in this Thingsboard implementation? This question will be answered through a penetration test. To limit the scope of the penetration test, two sub-research questions were formulated. One of these sub-research questions investigates the exploitability of the known JWT vulnerability CVE-2015-9235. This vulnerability sets the JWT signature algorithm to ''none'', bypassing the authentication. The second sub-research question explores whether the signature algorithm can be cracked through a brute force attack. Both sub-research questions were negated during this penetration test, indicating that the vulnerability in the Thingsboard implementation could not be exploited, and the signature algorithm could not be cracked using the tools employed. Furthermore, it was discovered through the experiment conducted during this penetration test that the JWTs in the Thingsboard implementation could not be manipulated using the approaches and tools employed.

Avui en dia, les dades genòmiques es representen en diferents formats de fitxer. El genoma és un dels tipus d'informació més sensible que hi ha i, per tant, té uns requisits de seguretat i privadesa molt estrictes. Aquest projecte està centrat en el desenvolupament de la segona versió de l'arquitectura modular anomenada Genomic Information Protection And Management System (GIPAMS) que implementa l'estàndard MPEG-G (ISO/IEC 23092 Genomic Information Representation). En concret, s'ha adaptat la primera versió afegint-li nous mòduls i refent d'altres per tal d'incorporar la possibilitat de protegir i xifrar les dades genòmiques. Addicionalment, s'han introduït mecanismes de control d'accés a la informació. D'aquesta manera, només els usuaris autoritzats poden treballar amb els recursos per als quals tenen permís. Per altra banda, a part d'implementar l'estàndard MPEG-G, en aquesta versió s'introdueix l'estàndard Crypt4GH i els algoritmes que defineix per xifrar i compartir dades genòmiques. Finalment, s'ha revisat el conjunt de l'arquitectura des d'un punt de vista de seguretat seguint els consells de Open Web Application Security Project (OWASP) per garantir que no es donen els riscos de seguretat més habituals identificats per aquesta organització. Nowadays, genomic information is currently represented in different file formats. Genomic data is one of the most sensitive types of information one can find. Therefore, it has very strict security and privacy requirements. This project is focused on the development of the second release of the modular architecture called Genomic Information Protection And Management System (GIPAMS) that implements the MPEG-G standard (ISO/IEC 23092 Genomic Information Representation). In particular, the first release has been adapted in order to add new modules and redo others to provide the ability to protect and encrypt genomic data. In addition, access control mechanisms have been put in place so that only users allowed to access specific resources can do it. Moreover, in addition to the MPEG-G standard implementation, this release introduces the Crypt4GH standard and the algorithms it defines for encrypting and sharing genomic data. Finally, the entire architecture has been revised in terms of security, following the Open Web Application Security Project (OWASP) advice to ensure that the most common security risks identified by this organization do not occur.

The purpose of this article is to prepare a security analysis of authentication and authorization mechanisms in web applications based on the REST architecture. The article analyzes the problems encountered during the implementation of the JSON Web Token (JWT) mechanism. The article presents examples of problems related to the implementation of authorization and authentication, and presents good practices that help ensure application security.

The development of e-commerce in Indonesia in the last five years has significantly increased the growth for logistics service companies. The Indonesian Logistics and Forwarders Association (ALFI) has predicted the growth potential of the logistics business in Indonesia to reach more than 30% by 2020. One of the efforts of logistics business companies to improve services in the logistics services business competition is to implement web service technology on mobile platforms, to easy access to services for customers. This research aims to build a web service with a RESTful approach. The REST architecture has limitations in the form of no authentication mechanism, so users can access and modify data. To improve its services, JSON Web Token (JWT) technology is needed in the authentication process and security of access rights. In terms of data storage and transmission security, a cryptographic algorithm is also needed to encrypt and maintain confidentiality in the database. RC4 algorithm is a cryptographic algorithm that is famous for its speed in the encoding process. RC4 encryption results are processed with the Base64 Algorithm so that encrypted messages can be stored in a database. The combination of the RC4 method with the Base64 method has strengthened aspects of database security. This research resulted in a prototype application that was built with a combination of web service methods, JWT and cryptographic techniques. The test results show that the web service application at the logistics service company that was created can run well with relatively fast access time, which is an average of 176 ms. With this access time, the process of managing data and information becomes more efficient because before making this application the process of handling a transaction takes up to 20 minutes., Perkembangan e-commerce di Indonesia dalam lima tahun terakhir telah meningkatkan pertumbuhan bagi perusahaan jasa logistik secara signifikan. Asosiasi Logistik dan Forwarder Indonesia (ALFI) telah memprediksi potensi pertumbuhan bisnis logistik di Indonesia bisa mencapai lebih dari 30% pada tahun 2020. Salah satu upaya perusahaan bisnis logistik untuk meningkatkan pelayanan dalam persaingan bisnis jasa logistik adalah menerapkan teknologi web service pada platform mobile, untuk kemudahan akses layanan bagi pelanggan. Penelitian ini bertujuan untuk membangun web service dengan pendekatan RESTful. Arsitektur REST memiliki keterbatasan berupa tidak ada mekanisme autentikasi, sehingga pengguna dapat mengakses dan memodifikasi data. Untuk menyempurnakan layanannya, diperlukan teknologi JSON Web Token (JWT) dalam proses autentikasi dan keamanan hak akses. Dalam sisi keamanan penyimpanan dan transmisi data, juga diperlukan sebuah algoritma kriptografi untuk mengenkripsi dan menjaga kerahasiaan pada basis data. Algoritma RC4 merupakan salah satu algoritma kriptografi yang terkenal dengan kecepatan dalam proses penyandian. Hasil enkripsi RC4 diproses dengan Algoritma Base64 agar pesan yang dienkrip dapat disimpan pada basis data. Kombinasi metode RC4 dengan metode Base64, telah memperkuat aspek keamanan basis data. Penelitian ini menghasilkan prototipe aplikasi yang dibangun dengan kombinasi metode web service, JWT maupun teknik-teknik kriptografi. Hasil pengujian menunjukkan bahwa aplikasi web service pada perusahaan jasa logistik yang diciptakan dapat berjalan dengan baik dengan waktu akses yang relatif cepat, yaitu rata-rata 176 ms. Dengan waktu akses ini maka proses pengelolaan data dan informasi menjadi lebih efisien karena sebelum dibuatnya aplikasi ini proses penanganan sebuah transaksi memakan waktu hingga 20 menit.

Аутентификация пользователя является важным критерием при формировании бизнес-процессов в различных сферах деятельности. Процесс аутентификации представляет собой проверку пользователя на подлинность введенных данных. Популярным способом аутентификации при разработке клиент серверных приложений на данный момент является стандарт JWT.

U okviru ovog rada osmišljeno je grafičko sučelje za upravljanje robotom koristeći rosbridge protokol. Sučelje je implementirano kao web aplikacija razvijena u Reactu koristeći HTML, CSS i Javascript. Rosbridge protokol povezuje web sučelje i ROS tako što JSON poruke, koje su široko prihvaćen format za prijenos podataka, mapira u ROS poruke i omogućuje njihovu međusobnu komunikaciju. Funkcionalnosti koje su implementirane su upravljanje robotom, dohvat informacija od robota, prikaz mape po kojoj se robot kreće i mogućnost zadavanja cilja unutar mape. Također, web sučelje je povezano s google maps sustavom i nudi mogućnost izračuna površine označenog poligona i nadmorske visine što će se koristiti za konfiguriranje parametara sustava. Within this paper, a graphical interface for managing robot was designed using rosbridge protocol. The interface is implemented as a web application developed in React using HTML, CSS and Javascript. The Rosbridge protocol connects the web interface and ROS by mapping JSON messages, which are a widely accepted data transfer format, into ROS messages and allows them to communicate with each other. The functionalities that have been implemented are moving robot with joystick, retrieval of information from the robot, display of the map on which the robot is moving and the possibility of setting a target within the map. Also, the web interface is connected to the google maps system and offers the possibility of calculating the marked area and altitude which will be used to configure the system parameters.

— Libraries are important in the world of education. This shows that there is a need for a system that supports library services. The existence of a library information system makes it easier for libraries to share information and data. In order for the system to share information or data, it requires Web Service technology, to enable the exchange of such information or data. Web Service is a form of development of current technology that can be used for system integration. Web Service is able to be a bridge between various existing systems. In this research, the Web Service technology used is RESTful Web Service. RESTful is one of the architectural designs contained in the API, which is able to work well because it has high and stable performance. The purpose of this research is to produce a library information system that is capable of exchanging data with other systems by implementing a RESTful Web Service using the Django REST Framework. Django REST Framework is a tool that can be used to create Web APIs, making it easier for us to create RESTful Web APIs. So this research produces a RESTful Web Service which is implemented in a university library information system with the GET, POST, PUT, DELETE methods and from the test results obtained the amount of data from the response time on these methods.Abstrak — Perpustakaan merupakan hal penting di dunia pendidikan. Hal ini menunjukkan bahwa perlu adanya suatu sistem yang mendukung pelayanan perpustakaan. Dengan adanya sistem informasi perpustakaan menjadikan perpustakaan lebih mudah dalam berbagi informasi dan data. Agar sistem tersebut dapat berbagi informasi atau data maka dibutuhkan teknologi Web Service, untuk memungkinkan terjadinya pertukaran informasi atau data tersebut. Web Service merupakan salah satu bentuk perkembangan dari teknologi saat ini yang dapat digunakan untuk integrasi sistem. Web Service mampu menjadi sebuah jembatan penghubung antara berbagai sistem yang ada. Pada penelitian ini, teknologi Web Service yang digunakan adalah RESTful Web Service. RESTful merupakan salah satu dari desain arsitektur yang terdapat di dalam API, yang mampu bekerja dengan baik karena memiliki kinerja yang tinggi dan stabil. Tujuan dari penelitian ini adalah untuk menghasilkan sistem informasi perpustakaan yang mampu bertukar data dengan sistem yang lain dengan cara mengimplementasikan RESTful Web Service menggunakan Django REST Framework. Django REST Framework merupakan tools yang dapat digunakan untuk membuat Web API, sehingga memudahkan kita untuk membuat Web API yang RESTful. Maka penelitian ini menghasilkan RESTful Web Service yang diimplementasikan pada sistem informasi perpustakaan perguruan tinggi dengan methods GET, POST, PUT, DELETE dan dari hasil pengujian didapatkan jumlah data dari response time pada methods tersebut.

This specification defines a profile for issuing OAuth 2.0 access tokens in JSON web token (JWT) format. Authorization servers and resource servers from different vendors can leverage this profile to issue and consume access tokens in interoperable manner.

The authorization request in OAuth 2.0 described in RFC 6749 utilizes query parameter serialization, which means that Authorization Request parameters are encoded in the URI of the request and sent through user agents such as web browsers. While it is easy to implement, it means that (a) the communication through the user agents are not integrity protected and thus the parameters can be tainted, and (b) the source of the communication is not authenticated. Because of these weaknesses, several attacks to the protocol have now been put forward. This document introduces the ability to send request parameters in a JSON Web Token (JWT) instead, which allows the request to be signed with JSON Web Signature (JWS) and encrypted with JSON Web Encryption (JWE) so that the integrity, source authentication and confidentiality property of the Authorization Request is attained. The request can be sent by value or by reference.

MEC technology provides a distributed computing environment in 5G mobile networks for application and service hosting. It allows customers with different requirements and professional competencies to use the services offered by external suppliers. We consider a service access control framework on 5G MEC networks that is efficient, flexible, and user-friendly. Its central element is the MEC Enabler, which handles AAA requests for stakeholders accessing services hosted on the edge servers. The JSON Web Token (JWT) open standard is a suitable tool for the MEC Enabler to manage access control credentials and transfer them securely between parties. In this paper, in the context of access control, we propose the token reference pattern called JSON MEC Access Token (JMAT) and analyze the effectiveness of its available protection methods in compliance with the standard requirements of MEC-hosted services in 5G networks.

The company has an important role in attracting the attention of customers by promoting its products and services so that it can be widely known by the community through the sales division (sales person). The biggest challenge faced by companies is related to marketing, namely stable and sustainable income growth, and customer loyalty. So that the application of information and communication technology is needed in the business world as a tool to win the main competition in marketing products or services. In the company, order data made by the sales person is still via telephone. You need an application to speed up the product ordering process to customers. To solve these problems, each sales person will use a sales order application through a smartphone device that will make product orders. And product ordering data will go to a web-based application run by admin for the invoice creation process. This application is designed using the RESTful API which is one of the implementation models of the web service and. In terms of data exchange security using the Json Web Token. With this sales order application, it can simplify the sales person's performance in marketing their products. This application work runs well on the web and android device so the process of ordering products becomes easier. The use or json web token authentification on the RESTful API makes the application more secure because this application can not be accessed if it does not use tokens. &nbsp, Perusahaan mempunyai peran penting didalam menarik perhatian pelanggan dengan mempromosikan produk dan layanannya sehingga dapat dikenal luas oleh masyarakat melalui divisi penjualan (sales person). Tantangan terbesar yang dihadapi oleh perusahaan sangat berkaitan dengan pemasaran, yaitu pertumbuhan pendapatan yang stabil dan berkelanjutan, serta loyalitas pelanggan. Sehingga penerapan teknologi informasi dan komunikasi diperlukan dalam dunia bisnis sebagai alat bantu memenangkan persaingan utama dalam memasarkan produk atau jasa. Di dalam perusahaan, data pemesanan yang dilakukan sales person masih melalui telephone. Dibutuhkan aplikasi untuk mempercepat proses pemesanan produk kepada pelanggan. Untuk memecahkan permasalahan tersebut, masing-masing sales person akan menggunakan aplikasi sales order melalui perangkat smartphone yang akan membuat pemesanan produk. Dan data pemesanan produk akan masuk ke aplikasi berbasis web yang dijalankan admin untuk proses pembuatan invoice. Aplikasi ini dirancang menggunakan RESTful API yang merupakan salah satu model implementasi dari web service. Keamanan dalam hal pertukaran data pada aplikasi ini menggunakan Json Web Token. Dengan adanya aplikasi sales order ini dapat mempermudah kinerja sales person dalam memasarkan produknya Aplikasi sales order ini berjalan baik pada web dan android sehingga proses pemesanan produk menjadi lebih mudah. Penggunaan autentifikasi json web token pada RESTful API ini membuat aplikasi menjadi lebih aman karena aplikasi tidak dapat diakses jika tidak menggunakan token

Today's technology needs are getting higher, one of the technologies that continues to grow now is Web Service (WS). WS can increase service flexibility on a system. However, security at WS is one of the things that needs attention. One effort to overcome this problem is JWT (JSON Web Token). JWT is one of the authentication mechanisms in WS, with a standard signature algorithm, HMAC SHA256, RSA-256 or ECDSA. In this research we will discuss the performance of JWT RSA-512 which is implemented on SOAP and RESTful. Because based on previous research the speed performance of the 512-bit algorithm is better, but it is not yet known if applied to JWT. The test results show that the speed of the JWT RSA-512 token on the RESTful process is superior to 24.69% compared to SOAP. Then the speed of the authentication of JWT RSA-512 tokens, RESTful is superior to 11.64% compared to SOAP. Whereas in testing the size of JWT RSA-512 generated tokens, RESTful is only 1.25% superior to SOAP.

This paper aims to present a new model of distributed system based on the Json Web Token (JWT) technology to answer the problems of load balancing on the one hand and the security of the communication between the agents on the other hand. This model is built around a new multi-agent system middleware. The proposed model is essentially based on an authentication module ensuring efficient load balancing as well as security of the communication, by guaranteeing, the integrity of the exchanged messages between the agents, the authentication of the agents, and non-repudiation, based on the asymmetric cryptographic technology. The article presents a theoretical analysis of the proposed model architecture, describing a secure, lightweight and highly scalable system for better security and load balancing management in distributed systems.

In cloud system, user identity authentication is a key problem. If design defects persist in a cloud user identity authentication scheme, direct risks of sensitive data loss and severe information breach will be incurred. At present, the main problem of cloud user identity management system is that it relies too much on third-party services. Although some third-party-detachment schemes have been proposed in recent years, most of them still rely heavily on cloud server-centered design system. In this paper, a cloud user identity management protocol based on ethereum blockchain was proposed, followed by an establishment of a simple credit management system framework. The new protocol is an improved version of CIDM (Consolidated Identity Management) referred to as EIDM (Ethrerum-based Identity Management) protocol. In the improved protocol, JWT (JSON Web Token) in OAuth 2.0 was used to introduce smart contracts into EIDM protocol, and the credit management system was added to the system so that it can provide a credible identity authentication protocol for cloud users and service providers. The new protocol solves the problem of over-reliance on third parties in the existing identity management system solutions. In the end, an analysis on the security of the new protocol showed that the EIDM protocol proposed in this paper presents more diversified security guarantees relative to the CIDM protocol. The performance evaluation results also indicated that the new protocol demonstrates better practicability and flexibility.

JSON Web Token (JWT) is a compact and self-contained mechanism, digitally authenticated and trusted, for transmitting data between various parties. They are mainly used for implementing stateless authentication mechanisms. The Open Authorization (OAuth 2.0) implementations are using JWTs for their access tokens. OAuth 2.0 and JWT are used token frameworks or standards for authorizing access to REST APIs because of their statelessness and signature implementation and JWT tokens are based on JSON and used in new authentication and authorization protocols in OAuth 2.0 because of their small size. When refresh tokens are stored in cookies, the size limit of a cookie or URL may be quickly exceeded. There may be refresh tokens for accessing users and getting the refresh token is a bit more complicated and refresh tokens in the browser require additional security measures and the attacker steals a refresh token and attempts to use it after the application has already used it. This implies that the attacker was able to steal a refresh token from the application. If the refresh token can be stolen, then so can the access token, even short token lifetimes can still lead to major abuse scenarios. In this article, we discuss the security properties of refresh tokens in the browser and the pattern to secure JWT tokens in the web front-end better. We propose a Backend for Frontend (BFF) pattern, where the token handling is deferred to the server-side component to a secure token that provides a lot of flexibility to the client-side.

Метою дипломної роботи є дослідження принципів організації авторизації в архітектурах FaaS–додатків, шаблонів та методів контролю ідентичності від поширених провайдерів хмарних обчислень та демонстрація прикладів практичної реалізації сервісів авторизації. З поширенням хмарних технологій, ІТ– індустрія все більше застосовує альтернативні рішення у сфері розробки та розміщення серверної частини додатків та сервісів. Значна доля розробників та власників ІТ– продуктів використовують сторонній інструментарій для організації тієї чи іншої частини власного програмного забезпечення. Таким чином, розробники ПЗ делегують певні повноваження хмарним провайдерам. Це стосується і таких складних процесів як реалізація процедури автентифікації та авторизації. Так у процесі дослідження питання організації авторизації у архітектурах FaaS–додатків, було складено порівняльні характеристики не лише сучасних шаблонів та методів контролю ідентичності, але й можливості для їх реалізації у середовищах різних провайдерів. При аналізі до уваги бралися: складність реалізації, ефективність використання у різних ситуаціях та архітектурах. Також було приведено основні можливості кожного з провайдерів хмарних рішень, що надає більш широку картину ринку в цілому. У ході проведеного в роботі аналізу зазначається, що безсерверна інфраструктура володіє достатнім переліком можливих інструментів для рішення різного типу завдань, які виникають як перед великими компаніями так і малим бізнесом. В практичній частині роботи на прикладі реалізації сервісів авторизації з використанням авторизації на основі токенів за допомогою API шлюзу у популярного провайдера Amazon Web Services, було показано, як зорганізується авторизація користувачів та сторонніх сервісів в додатках з FaaS архітектурою. Проведений в роботі аналіз може бути корисним для подальшого розгляду не тільки рішень контролю ідентичності у FaaS додатках, а й у досліджені методів та шаблонів взаємодії з базами даних та іншими сторонніми сервісами провайдерів. Створений облік ресурсів та інструментів є певним вектором розвитку даної теми у подальшому. Загальний обсяг роботи 101 с., 27 рис., 13 таблиць , 2 додатки , 20 джерел. The purpose of this thesis is to investigate the principles of authorization organization in FaaS application architectures, patterns and identity control methods in common cloud computing providers and consider examples of authorization services implementation. At a time of dramatic growth in the world of cloud technology, the IT industry is increasingly turning to alternative solutions for hosting and debugging the server parts of applications and services. A large percentage of developers and owners of IT products are resorting to using third-party tools to organize some part of their own software. Thus, delegation of certain powers occurs during software development, namely, such complicated processes as providing authentication and authorization procedures. So, in the process of research on the issue of organizing of authorization in the architectures of FaaS-applications, it was made a comparative characteristics not only of templates and methods of identity control. Namely, the possibility of organization in the environment of different providers, complexity of implementation, efficiency of use in different situations and architectures. The main features of each of the cloud solution providers were also given, provides a broader picture of the market as a whole. In the course of the study it was noted that serverless infrastructure has a sufficient list of possible tools to address different types of tasks that arise for both large companies and small businesses. On the example of implementation of authorization services, it was presented, according to which the development and configuration of the main parts of the authorization architecture of FaaS- applications takes place. The conclusion of the work is to implement an example of authorization services using different types of templates and methods. The basis of which is to cover the process of authentication and identity control of not only users but also applications. This theoretical basis for the further examination of not only solutions in the direction of identity control, but also in the study of methods and patterns of interaction with databases and other third-party services providers. The created account of resources and tools is a definite vector of development of this topic in the future. The total volume of work is 101 pages, 27 figures, 13 tables, 2 appendices, 22 sources.

The system proposed in this paper is an advanced version of online education platforms. Celestial Learning is a one-stop solution for authors and subscribers to enhance their learning. To make a lecture effective, proper involvement of both learners and authors is crucial. To reinforce the teaching and learning process, the proposed system provides a web application platform to the content creator to deliver their courses to the audience irrespective of their physical location. Even the students/subscribers could access the course at a flexible pace. The system revolves around two parts. The first part and main distinguishing factor of this system is the security which is lacking in the existing solutions. Due to less security, the courses get uploaded in an unauthorized manner which reduces the credibility of authors. The second part of the system aims at providing a hassle-free experience of learning with some key features such as responsive and attractive User Interface (UI), Live sessions, full-fledged analytical performance manager. An open discussion forum for authors and subscribers which facilitates to resolve their query. The front end of the web application is in React, Material UI whereas the Node-Express server handles the backend and for a user authentication method used the JSON Web Token (JWT). In terms of storage, the system uses MongoDB and cloud platforms for deploying the videos.

This paper describes the security architecture for a modern cloud-based command and control system. This design could be easily extended to the other aspects of a ground system such as mission planning, mission data processing, and ground terminals, but is being first implemented for the COSMOS C2 product. A ground system's security design needs to be resistant to both internal and external threats, while remaining performant and scalable to ever increasingly sized clusters of satellites. The following design takes a hybrid trust approach providing a level of zero-trust for internal connections, while also providing a strong level of security for external connections. The use of well-defined standards is critical to a robust security implementation. This design focuses on the use of JSON Web Token (JWT) which is an open standard established in RFC7519. The JWT tokens are distributed using the OpenID Connect protocol which is maintained by the OpenID Foundation. OpenID Connect hosted by a Single-Sign-On provider allows a single login to access multiple microservices. Finally, Infrastructure can be further protected by defining strong software communication rules. Any software/service that is not expected to connect to a microservice can be explicitly denied access by specifically defining rules as to what can talk to what. Istio is discussed as a technology to enforce these rules.

In Wi-Fi Protected Access 3 (WPA3), a secure connection is established in two sequential stages. Firstly, in the authentication and association stage, a pairwise master key (PMK) is generated. Secondly, in the post-association stage, a pairwise transient key (PTK) is generated from PMK using the traditional 4-way handshake protocol. To reduce the heavy load of the first stage, PMK caching can be used. If the client and AP are previously authenticated and have a PMK cache, the first heavy stage can be skipped and the cached PMK can be used to directly execute the 4-way handshake. However, PMK caching is a very primitive technology to manage shared key between a client and AP and there are many limitations, AP has to manage a stateful cache for a large number of clients, cache lifetime is limited, etc. Paired token (PT)is a new secondary credential scheme that provides stateless pre-shared key (PSK) in a client-server environment. The server issues a paired token (public token and secret token) to an authenticated client where the public token has the role of signed identity and the secret token is a kind of shared secret. Once a client is equipped with PT, it can be used for many symmetric key-based cryptographic applications such as authentication, authorization, key establishment, etc. In this paper, we apply the PT approach to WPA3 and try to replace the PMK caching with the one-time authenticated key establishment using PT. At the end of a successful full handshake, AP securely issues PT to the client. Then, in subsequent re-association requests, the client and AP can compute the same one-time authenticated PMK using PT in a stateless way. Using this kind of stateless re-association technology, AP can provide a high performance Wi-Fi service to a larger number of clients.

En este proyecto se va a desarrollar una aplicación web para poder hacer la compra a personas que no pueden llevarla a cabo por sí mismas. La web permitirá al usuario realizar una cesta de la compra. Creando y añadiendo artículos para que otro usuario pueda irlos a comprar. Los dos usuarios podrán comunicarse mediante un chat de texto relacionado con la cesta. Los usuarios deberán obtener una cuenta asociada al portal mediante un formulario de registro. Una vez dispongan de cuenta, podrán iniciar sesión en el portal. Como objetivos secundarios se va a implementar: una interfaz totalmente ajustable al tamaño del dispositivo que lo utiliza, un sistema que informa al usuario cuando se disponga de una nueva versión de la web y un entorno de puesta en producción eficiente con contenedores para poder realizar una entrega continua del software. In this project, we are going to develop a web application that is able to make purchases to persons who cannot carry it out on their own. The web will allow the user to make a shopping cart. Creating and adding items so that another user can buy them. The two users will be able to communicate through a text chat related to the basket. Users must obtain an account associated with the portal through a registration form. Once they have an account, they will be able to log into the portal. As secondary objectives, we will implement: an interface that is fully adjustable to the size of the device that uses it, a system that informs the user when a new version of the web is available, and an efficient production start-up environment with containers to be able to deliver the software with a continuous method. En aquest projecte es desenvoluparà una aplicació web per poder fer la compra a persones que no poden dur-la a terme per si mateixes. El web permetrà a l'usuari realitzar una cistella de la compra. Creant i afegint articles perquè un altre usuari pugui anar-los a comprar. Els dos usuaris podran comunicar-se mitjançant un xat de text relacionat amb la cistella. Els usuaris hauran d'obtenir un compte associat al portal mitjançant un formulari de registre. Un cop disposin de compte, podran iniciar sessió al portal. Com a objectius secundaris s'implementarà: una interfície totalment ajustable a la mida del dispositiu que l'utilitza, un sistema que informa l'usuari quan es disposi d'una nova versió de la web i un entorn de posada en producció eficient amb contenidors per poder fer un lliurament continu del programari.

Since 2017, the Worldwide LHC Computing Grid (WLCG) has been working towards enabling token based authentication and authorisation throughout its entire middleware stack. Following the publication of the WLCG Common JSON Web Token (JWT) Schema v1.0 [1] in 2019, middleware developers have been able to enhance their services to consume and validate the JWT-based [2] OAuth2.0 [3] tokens and process the authorization information they convey. Complex scenarios, involving multiple delegation steps and command line flows, are a key challenge to be addressed in order for the system to be fully operational. This paper expands on the anticipated token based workflows, with a particular focus on local storage of tokens and their discovery by services. The authors include a walk-through of this token flow in the RUCIO managed data-transfer scenario, including delegation to FTS and authorised access to storage elements. Next steps are presented, including the current target of submitting production jobs authorised by Tokens within 2021.

El presente trabajo documenta el desarrollo de un prototipo de plataforma web que permite realizar la evaluación docente en tiempo real y la toma de asistencia, dicho prototipo fue implementado utilizando tecnologías como ReactJS, NestJS y herramientas como SonarLint, TSLint para el análisis de código estático. La plataforma busca la mejora continua de la educación mediante retroalimentación anónima acerca de la experiencia que tienen los estudiantes respecto a las clases impartidas; la cuál ayuda al docente y a los responsables de velar por mantener óptimos niveles de desempeño en la docencia. This work documents the development of a web platform prototype that allows real-time teacher evaluation and attendance taking, this prototype was implemented using technologies such as ReactJS, NestJS and tools such as SonarLint, TSLint for static code analysis. The platform seeks the continuous improvement of education through anonymous feedback about the experience that students have regarding the classes taught; which helps the teacher and those responsible for ensuring optimal performance levels in teaching. Pregrado Ingeniero(a) de Sistemas y Computación CONTENIDO Introducción 3 Definición del problema 5 Pregunta de investigación 6 Objetivos 7 Objetivo general 7 Objetivos específicos 7 Marco referencial 8 Diseño metodológico 11 Desarrollo 18 Requisitos y arquitectura de la plataforma 18 Casos de uso: 18 Arquitectura y generalidades de la implementación: 22 Implementación por módulos 24 Módulo de autenticación 24 Módulo de gestión de cursos y clases 28 Módulo de asistencia 32 Módulo de evaluación docente 33 Módulo de visualización de resultados 34 Módulo de dashboard para la visualización de resultados del docente 35 Conclusiones 38 Bibliografía 39

During the Covid-19 pandemic the government implement the imposition of Large-Scale Social Restrictions (PSBB). This PSBB also has an impact on companies in Jabodetabek including PT Akses Digital Indonesia. In order to comply with regulations given by the government, PT Akses Digital Indonesia has implemented a Work From Home (WFH) policy for its employees. During the implementation of the WFH policy, had difficulty monitoring the performance of its employees. Attendance is one measure of the level of performance, especially employee discipline. Based on the identification of the problem, an employee presence web service application is needed. Of course, this application should be as effective as conventional fingerprint machines in offices. This application is accompanied by a validation feature using geotagging, fingerprint and device checkers to minimize fraud when employees make attendance. This study implements the RESTful API security feature on web services using JSON Web Token (JWT) based on the HMAC SHA-256 algorithm. All implementation stages are tested using the Black Box method and show that JWT can secure the authentication process and secure data. The validation feature is able to provide attendance data with an accuracy of 90,9%.

Batikkita is an android based application and web framework laravel web service architecture that is used to bring together between craftsmen and consumers of batik Trusmi and batikkita application with the e-commerce model used is business to customer. The backend system interface used is a web framework while the frontend system interface used is android. The problem that arises from the Batikkita application is that the security of users, both as sellers and consumers, is very vulnerable to being hacked, so it is very detrimental to both sellers and buyers. This study aims to implement the JSON Web Token based on the HMAC SHA-512 algorithm in the Batikkita application in order to provide a sense of security for both the seller and the buyer before entering the sales transaction page. The application development method used is Rapid Application Development because the cycle used to develop our batik application is very short so it is very helpful in this research. While the implementation of JSON Web Token with the HMAC SHA-512 algorithm in the Batikkita application is used to improve user security when logging in to the Batikkita application in the form of a token and the password used by the user is wrapped in a token given by the Batikkita application. As a comparison, the HMAC SHA-256 algorithm and the HMAC SHA-384 algorithm are used. The results obtained from testing the implementation of JSON Web Token with the SHA-512 algorithm in our batik application, for an average increase of speed between 138.8 milliseconds for SOAP and 122.7 milliseconds for REST compared to the HMAC SHA-256 algorithm and the HMAC SHA-algorithm. 384. While the required token size is greater between 2.13 kb for SOAP and 2.11 kb for REST compared to the HMAC SHA-256 algorithm and the HMAC SHA-384 algorithm., Batikkita adalah aplikasi berbasis android dan web framework laravel arsitektur web service yang digunakan untuk mempertemukan antara pengrajin dan konsumen batik Trusmi serta aplikasi Batikkita dengan model e-commerce yang digunakan adalah bussiness to customer. Untuk interface backend system yang digunakan adalah web framework sedangkan interface frontend system yang digunakan adalah android. Permasalahan yang ditimbulkan dari aplikasi Batikkita adalah keamanan pengguna baik sebagai penjual maupun sebagai konsumen sangat rentan untuk diretas, sehingga sangat merugikan baik dari penjual maupun pembeli. Penelitian ini bertujuan untuk mengimplementasikan JSON Web Token berbasis algoritma HMAC SHA-512 pada aplikasi Batikita agar dapat memberikan rasa aman baik dari sisi penjual maupun pembeli sebelum masuk ke halaman transaksi penjualan. Metode pengembangan aplikasi yang digunakan adalah Rapid Application Development karena siklus yang digunakan mengembangkan aplikasi Batikkita sangat pendek sehingga sangat membantu dalam penelitian ini. Sedangkan implementasi JSON Web Token dengan algoritma HMAC SHA-512 pada aplikasi batikkita digunakan untuk meningkatkan keamanan pengguna pada saat login pada aplikasi Batikkita dalam bentuk token dan kata sandi yang digunakan oleh pengguna terbungkus oleh token yang diberikan oleh aplikasi Batikkita. Sebagai perbandingan digunakan algoritma HMAC SHA-256 dan algoritma HMAC SHA-384. Hasil yang diperoleh dari pengujian implementasi JSON Web Token dengan algoritma SHA-512 pada aplikasi Batikkita, untuk kecepatan meningkat rata-rata antara 138,8 milisecond untuk SOAP dan 122,7 milisecond untuk REST dibandingkan dengan algoritma HMAC SHA-256 dan algoritma HMAC SHA-384. Sedangkan ukuran token yang dibutuhkan lebih besar antara 2,13 kb untuk SOAP dan 2,11 kb untuk REST dibandingkan dengan algoritma HMAC SHA-256 dan algoritma HMAC SHA-384.

In WPA3 secure connection is executed in two sequential stages. Firstly, in authentication and association stage a pairwise master key (PMK) is generated. Secondly, in post-association stage a pairwise transient key (PTK) is generated from PMK using the traditional 4-way handshake protocol. To reduce the heavy computation of the first stage PMK caching can be used. If client and AP are previously authenticated and has PMK cache, client can skip the first heavy stage and reuse the cached PMK to directly execute the 4-way handshake. But PMK caching is a very primitive technology to manage shared key between client and AP and there are many limitations; AP has to manage stateful cache for multiple clients, cache lifetime is limited, etc. Paired token (PT) \cite{LZ} is a new secondary credential scheme that provides stateless pre-shared key (PSK) in client-server environment. Server issues paired token (public token and secret token) to authenticated client where public token has the role of signed identity and secret token is a kind of shared secret. Once client is equipped with PT, it can be used for many symmetric key based cryptographic applications such as authentication, authorization, key establishment, etc. In this paper we apply the PT approach to WPA3 and try to replace the PMK caching with the one-time authenticated key establishment using PT. At the end of the authentication and association stage AP securely issues PT to client. Then in reassociation stage client and AP can compute the same one-time authenticated PMK from PT in stateless way and compute PTK using the traditional 4-way handshake protocol. Using this kind of stateless reassociation technology AP can provide high performance service to huge number of clients.

In almost every organization where user sensitive data is available, security and privacy of the data plays a vital role. As storage of these information is overhead in database, Tokens are generated which handles sessions and also self contains user details. One of such widely used stateless token is Json Web Token. This paper deals with the research that follows implementation of authentication and authorization technique using JSON web token which will make web service a role based one .In the project under taken, Json web token is generated in a more secured way by choosing the secret key for web token wisely. Usually key for the token was a mere string or the set of keys stored in a key ring in the database and used alternately for the users to create the token. Or one more trial model is created where captcha was used in short a random number was generated and used as secret key for token generation but the main issue was increased storage. Thus storage is tried to reduce also less predictive secret key is generated in this project.

Student data that are public and stored on Universitas Klabat currently be stored in a local database and can only be accessed by the database administrator. A RESTful web service acts as a medium that provides access to the data for those who have permission, improving the data's accessibility. Any user eligible by the web service can use the Universitas Klabat Information System data to develop a mobile or another web application without making another similar database, thus eliminating the redundant process of making a duplicate database. A JSON Web Token is also used in this web service to ensure that the person accessing the web service is authorized to access the specific data. The agile method is used to develop this application. In conclusion, the web service can create, read, update, delete operation regarding the student database and provide it to the user that is authorized with a valid JSON Web Token.

In the Covid-19 pandemic phase, some business processes were halted, adapted, and modified to deal with the policy of social restrictions. This impact is experienced by all levels of society, including athletes who are forced to do training from home (Training From Home). Performance evaluation of athletes who do exercises from home must be able to be evaluated remotely, including in terms of presence during the exercise training program. Presence is one of the benchmarks of a person's level of performance or activity in terms of accuracy and discipline in a program of activities. Attendance activities in the form of check-in must be ensured safe and accurate, especially if there is data connectivity with the webserver. This study aims to implement security features with JSON Web Token (JWT) based on the 256 Hash algorithm. The research also implements geo-tagging features to obtain accurate coordinates based on location points. Athlete attendance data obtained by the presence of these features are then synchronized via web service using the REST architecture. All stages of implementation are then tested by the Black Box method, and the results show that JSON Web Token (JWT) is able to secure the authentication and data security process, while the Geo-tagging feature is capable of sending accurate position data. Testing the functionality of the web service shows that all features work well within 44.8 ms, while the positioning accuracy of the geo-tagging feature reaches an accuracy of 90.9%., Dalam fase pandemi Covid-19, beberapa proses bisnis menjadi terhenti, mengalami adaptasi dan modifikasi untuk menghadapi kebijakan pembatasan sosial. Dampak ini dialami oleh seluruh lapisan masyarakat termasuk bagi para atlet yang terpaksa harus melakukan latihan dari rumah (Training From Home). Penilaian kinerja atlet yang melakukan latihan dari rumah, harus dapat dievaluasi dari jarak jauh, termasuk dalam hal presensi selama melakukan program latihan olahraga. Presensi merupakan salah satu tolak ukur dari tingkat kinerja atau keaktifan seseorang dalam hal ketepatan dan kedisiplinan di suatu program kegiatan. Kegiatan presensi berupa check-in harus dipastikan aman dan akurat terutama bila terdapat konektifitas data dengan web server. Tujuan penelitian ini adalah mengimplementasi fitur keamanan dengan JSON Web Token (JWT) berbasis algoritma Hash 256 Penelitian juga melakukan implementasi fitur geo-tagging untuk mendapatkan titik lokasi berbasis koordinat yang akurat. Data presensi atlet yang didapatkan dengan adanya fitur-fitur tersebut kemudian disinkronisasi melalui web service menggunakan arsitektur REST. Seluruh tahap implementasi kemudian diuji dengan metode Black Box, dan hasil menunjukkan bahwa JSON Web Token (JWT) mampu mengamankan proses autentikasi dan pengamanan data, sementara fitur Geo-tagging mampu mengirimkan data posisi yang akurat. Pengujian fungsionalitas pada web service menunjukkan bahwa seluruh fitur bekerja dengan baik dalam waktu 44.8 ms, sementara ketepatan posisi dari fitur geo-tagging mencapai akurasi sebesar 90,9%.

This specification describes how to declare in a JSON Web Token (JWT) that the presenter of the JWT possesses a particular proof-of- possession key and how the recipient can cryptographically confirm proof of possession of the key by the presenter. Being able to prove possession of a key is also sometimes described as the presenter being a holder-of-key.

JSON Web Tokens, also known as JWTs, are URL-safe JSON-based security tokens that contain a set of claims that can be signed and/or encrypted. JWTs are being widely used and deployed as a simple security token format in numerous protocols and applications, both in the area of digital identity, and in other application areas. The goal of this Best Current Practices document is to provide actionable guidance leading to secure implementation and deployment of JWTs.

Authentication and authorization are the two aspects of Spring security system, and they are shortcomings. In this paper, we study the spring security mechanism and some improvements and optimizations based on JSON Web Token and RBAC model. Furthermore, a trust RBAC model is proposed, and we expounded its structure from direct trust and indirect trust. The simulation results show that the method we proposed has a good effect.

Аутентификация необходима для подтверждения личности зарегистрированного пользователя. Авторизация – для проверки его прав на доступ к определенным ресурсам. В статье рассмотрены аутентификация и авторизация на сайтах средствами PHP.

There is rapid interest growing in the use of smart, connected devices. The developing world market for smart technology is evolving to adopt and adapt to the interconnected world of devices leading to the Internet of Things (IoT) everywhere. This research paper presents the design, development, and deployment of a prototype for the secure wireless home automation system with OpenHAB 2. We employed the use of two (2) high-performance microcontrollers, namely, the Arduino Mega 2560, interfaced with a 16-channel relay, and Raspberry Pi Model B, running the OpenHAB software. The Raspberry Pi functioned as the server to develop a prototype of an automated smart home that is remotely controllable from both a web application and an Android mobile app. In designing a wireless controlled switch for home appliances, two security procedures were implemented, namely, the token-based JSON Web Token (JWT) interface and Advanced Encryption Standard (AES) procedures for authentication and data encryption. Our system delivered a home automation system that leverages on the power of the latest version of OpenHAB to maximize productivity and overall home security while making it adaptable to the management of individual devices. When tested, both the developed hardware and software modules performed extremely well to meet the goal of a secured home automation system. Industry-standard penetration testing tools and frameworks, including Aircrack-ng, were utilized; wireless network audit began with a full sweep of the wireless frequencies with excellent results. It also ensures the efficient use of energy in the home as devices are intelligently controlled from both mobile and web applications. The results of the design and implementation of the additional layer for the security of the OpenHAB framework provide various theoretical and practical implications for home automation.

Penelitian ini bertujuan untuk mengamankan pengguna (Client) dari aplikasi web harus mempercayai developer aplikasi untuk mengambil tindakan pencegahan keamanan yang diperlukan. Banyak Developer aplikasi Web, di sisi lain, beranggapan bahwa aspek keamanan sangat sulit dan tidak mudah untuk dilakukan.Seiring berjalannya waktu, session dapat dengan mudah menjadi celah yang dapat dengan mudah dilewati oleh penyerang. Hal ini menyebabkan mekanisme keamanan Web yang kurang maksimal. JWT (Json Web Token) menawarkan pendekatan yang berbeda dan mampu mengatasi setiap celah yang dimiliki oleh session. JWT dapat diartikan sebagai sebuah claim yang berisikan identitas client, yang digunakan dalam proses identifikasi. JWT merupakan sarana yang mewakili klaim yang akan ditransfer antara dua pihak (dalam hal ini, client dan server). Klaim dalam sebuah JWT data dikodekan dalam objek JSON yang ditandatangani secara digital menggunakan JSON Web Signature (JWS) dan dienkripsi menggunakan JSON Web Encryption (JWE). Menggunakan JWT dapat memungkinkan penerbit token untuk membuat pernyataan tentang subjek token kepada audiens yang dimaksudkan dengan cara penerima dapat memverifikasi bahwa data yang diperoleh dibuat oleh penerbit. Kemampuan ini merupakan dasar untuk sistem identitas digital. This study aims to secure the users of the web application must trust the application developer to take the necessary safety precautions. Many Web application developers, on the other hand, assume that the security aspect is very difficult and not easy to do. Over time, the session can easily become a gap that the attacker can easily pass. This causes a less than optimal Web security mechanism, (Json Web Token) offers a different approach and is able to overcome any loopholes that the session has. can be interpreted as a claim containing the client's identity, which is used in the identification process. is a means that represents claims claims that will be transferred between two parties (in this case, client and server). Claims in a data are encoded in a JSON object digitally signed using JSON Web Signature (JWS) and encrypted using JSON Web Encryption (JWE). Using a can allow the token publisher to make a statement about the subject token to the audience which is intended by the way the recipient can verify that the data obtained is made by the publisher. This capability is the basis for a digital identity system.

Growing digital world has led to enormous data. With the growing data, its availability and processing have become a tedious task which is rescued by cloud computing. The cloud computing and data integration pose critical security concern to protect the data from unauthorized access. The current literature suggests various data access control schemes and models for cloud, but all provide permanent access to the resources, i.e., once a user is authenticated, either he is required or is not to be authenticated or authorized for subsequent requests. The data industry nowadays works on auto-expiry access tokens with traditional access control mechanisms which the current literature lacks. This paper contains a framework for data privacy using contextual information, attribute-based encryption, time-based assured data deletion, JSON Web Token (JWT) for token-based authorization, challenge response-based authentication, policy and context update with hidden policy for attribute-based encryption.