Reviewing the Security Features in Contemporary Security Policies and Models for Multiple Platforms

Modern web applications use complex data models and access control rules which lead to data integrity and access control errors. One approach to find such errors is to use formal verification techniques. However, as a first step, most formal verification techniques require extraction of a formal model which is a difficult problem in itself due to dynamic features of modern languages, and it is typically done either manually, or using ad hoc techniques. In this paper, we present a technique called symbolic model extraction for extracting formal data models from web applications. The key ideas of symbolic model extraction are 1) to use the source language interpreter for model extraction, which enables us to handle dynamic features of the language, 2) to use code instrumentation so that execution of each instrumented piece of code returns the formal model that corresponds to that piece of code, 3) to instrument the code dynamically so that the models of methods that are created at runtime can also be extracted, and 4) to execute both sides of branches during instrumented execution so that all program behaviors can be covered in a single instrumented execution. We implemented the symbolic model extraction technique for the Rails framework and used it to extract data and access control models from web applications. Our experiments demonstrate that symbolic model extraction is scalable and extracts formal models that are precise enough to find bugs in real-world applications without reporting too many false positives.

In the process of sending information from sender to receiver, an unauthorized user may work in an active way (update it) or passive way (read or delay in sending). There must be some techniques which assures receiver that whatever information received from authorized user as well as must be same as sent from sender side, in addition to this receiver never make Denial of service. Nowadays sharing of information or resources is a very common thing from single user to the network to the cloud. When information is moving from one node to another node, security is a big challenge. When information is stored on the user’s computer, it is under control but when it is in movement user lose control over it. In the world of security, to convert information from one form to another form, Encryption is used, so that only authorized party will able to read. Encryption is a technique for any security-conscious organization.In this paper, we present basic access control models along with encryption techniques.

Delegation is a process of sharing access rights by users of an access control model. It facilitates the distribution of authorities in the model. It is also useful in collaborative environments. Despite the advantages, delegation may have an impact on the access control model's security. Allowing users to share access rights without the control of an administrator can be used by malicious users to exploit the model. Delegation may also result in privacy violations if it allows accessing data without the data provider's consent. Even though the consent is taken, the privacy can still be violated if the data is used differently than the data provider agreed. Our work investigates data privacy in delegation. As a contribution, a privacy model is introduced that allows a data provider setting privacy policies that state how their data should be used by different organizations or parties who are interested in their data. Based on this setting, a delegation model is designed to consider the privacy policies in taking delegation decisions and also, to set the data usage criteria for the access right receivers. In addition to privacy policies, several delegation policies and constraint have been used to control delegation operations. Delegation is studied within a party and between two parties.

To provide security for web applications in recent years is considered an obsession for many companies and users. The Cross site scripting (XSS) attacks always occupy the top most priority over other site or Web application threats. Once an intruder advances intended access of the authenticate user’s web-browser and may perform session hijacking, cookie-stealing, malicious redirection and malware spreading. As prevention against such attacks, it is essential to implement security measures that certainly block the third party intrusion. In this paper, we provide an analysis and defense mechanism against XSS attacks. We propose a model that highlights the key weaknesses enabling these attacks, and that provides a common perspective for studying the available defenses. The research concerned with websites created by using open source tools that face an attacks which allow attacker to steal user passwords, take control of a user's session, run malicious code, or be used as part of a phishing scam. Then the research present a solution of storing passwords and sensitive data Using new security model (NSM) that is composed from a secret query key (SQK) randomly represents a publicly string stored in the database that consists of hexadecimal representation of an 8 byte for each user password generated. This hashes the password with the secret query key(SQK) so that it can be stored securely in a database. Then we encrypt the output of this statement (64 byte hexadecimal string) representing the 32 byte sha256 hash of the password. The output after encryption using SHA-256 cryptographic function generates a strong password that cannot be recovered from the hash. This hash encryption technique is merged with stored procedure statements which are generated by recomputed query statements to produce a strong security model (NSM) for the purpose of encrypting and decrypting passwords during, registration ,login, and authentication processes, This model deploying a novel security technique that is very effective and completely prevents cross site scripting (XSS) attacks.

Privacy and data security are critical aspects in databases, mainly when the latter are publically accessed such in social networks. Furthermore, for advanced databases, such as NoSQL ones, security models and security meta-data must be integrated to the business specification and data. In the literature, the proposed models for NoSQL databases can be considered as static, in the sense where the privileges for a given user are predefined and remain unchanged during job sessions. In this paper, we propose a novel model for NoSQL database access control that we aim that it will be dynamic. To be able to design such model, we have considered the Trust concept to compute the reputation degree for a given user that plays a given role.

Although using advanced Web technologies at their core, e-books represent a parallel universe to everyday Web documents. Their production workflows, user interfaces, their security, access, or privacy models, etc, are all distinct. There is a lack of a vision on how to unify Digital Publishing and the Web. Conceptually, what is important is the *content* for Web documents that should be unique. Whether that content is portable (offline) or online should merely be a particular *state* at a point it time and it should be easy for the user to provide a portable state of the same document, synchronize it with the online version when possible, etc. To achieve this vision the community has to define a general, portable Web document format based on current Web technologies. EPUB3 has already made a huge step in this direction. But technical challenges remain. This includes the usage of a general packaging format both to Web browsers and ebooks; unification of security, privacy, and access control models; general and portable annotation systems; defining general linking and anchoring structures. This presentation will outline the vision and address some of the relevant technical issues: the goal is to set a direction for a work that the overall Web and publishing community has to solve jointly.

Enforcing role based access control model with multimedia signatures

SummaryIn a recent scenario of a computing environment, the Internet of Things (IoT) provides a greater impact in several applications and services. For that Edge Computing techniques are effectively incorporated, in which the sensitive data are stored on servers. As a result, edge computing allows for data storage and operation at the network's edge to emerge as optimistic advancement. Regardless, the distinctive characteristics of edge computing including real‐time computing, content perception and parallel processing have introduced a number of innovative challenges in the domain of privacy preservation and data security. Edge computing provides an extension of the cloud for designing and deploying new security resolutions in the area of IoT. In this paper, a Trusted Platform Module with Ciphertext‐policy attribute‐based encryption technique is introduced to provide a solution to a multilayer privacy‐preserving model for efficient data storage. The developed model is adaptable and has a reliable data access control mechanism. Further, the results of the experiments demonstrate that the suggested technique operates better and give 83% results in terms of storage cost, load testing, effective runtime execution, higher security, credibility, and efficiency.

Internet of Things (IoT) has already become an essential part of our daily lives, from mobile phones connected to fitness bands and software applications (apps) controlling the household appliances. Everyday objects like cameras, smart watches, home automation systems, and smartphones are connected to the Internet for sending and receiving data build an IoT network. The advent of IoT in our day-to-day lives has induced variety and volume of data to be present in the shared space. Notwithstanding the advantages of IoT, it also presents a range of potential security risks. Additionally, the traditional IT security models are unable to cope up with the diverse nature of “things” in the IoT. Enterprises are also looking for strategies to meet ever-increasing demands for dynamic, scalable, and adaptive security requirements of IoT. This chapter provides recommendations for leveraging the benefits of traditional secure data handling in the IoT networks with a flavor of dynamism and scalability. Analyzing the current security challenges and constraints posed by the IoT devices, illustration of how devices interchange the sensitive information securely is also provided. The chapter focuses, mainly, on the most relevant available solutions related to the IoT security, e.g., context-based data access control, user identity masking, OAuth authorization, and device-based certificates.

With the idea of new developing technologies and the rapid change in our technical environment, there is a need for smarter, more efficient technology to keep up with the needs of today's world. Thus, the idea of smart cities has come into being. The purpose of this chapter is to promote the idea of building a smart city and providing a framework for future development of the same. We are moving towards a more futuristic world where everything is connected and done over the internet, which will create more network dependency. The problem with the concept of smart cities is the need for better technologies to improve the system of data transfer to address the problem of trust in the system, as massive amounts of people's private data is at stake with bad actors trying to hack the system to gain access to it. There is also the problem of the massive amounts of data produced in smart cities, so there is a need to provide a framework to efficiently store all the data. These problems can be solved with the help of technologies such as blockchain and cloud computing. Cloud computing can be seen as a way of sharing resources offering compute, storage, databases, and network services that can be used on a larger scale. Cloud computing stores massive amounts of data, it can also be used to share and transfer data between networks in a cloud, it is cost-effective, and you can also retrieve lost data or backup data when needed. Despite cloud computing being so great, it also has its own drawbacks. The problem of security in cloud storage is ever-increasing; since cloud storage, centralized systems have been a major target for hackers and data breaches, and the data in the cloud can be tampered with and accessed by unauthorized users. If data is being transferred through the cloud it can be intercepted during transmission because of the problem of encryption. These problems can be solved as well as the system being improved and made faster with the help of blockchain. Blockchain is a database or ledger that is shared across a network. The ledger is encrypted so that only people who are authorized can access the data. Blockchain will decentralize the data stored, which will improve the security of the data immensely. If a hacker targets a single block in a node, it will not have much effect and will continue to function. Block chain works by breaking the data into smaller chunks, and the chunks are distributed in a way that even if the network is down the data will still be available. While a file is being shared it is broken into smaller pieces and sent in a way that the file transfer is quicker. The files are encrypted using a cryptographic hash table and each individual shard or part of the file is also encrypted, making the security even tighter. With the help of blockchain, the storage of files will become much cheaper and more secure. A framework is provided to manage and secure the data acquired from IoT devices through encryption using Advanced Encryption Standard (AES) algorithm and storing the data in a private or public cloud depending on the data; and then decrypting the data and sending it to the users who requested the data or for further analysis. This chapter provides a framework for a smart city storage and security model and can be used as a prototype model for future development in the field.

The simple network management protocol (SNMP) is widely used for remote network resource management due to its simplicity and distributed management capabilities. However, the increased use of SNMP to manage and control network resources such as routers and servers also introduces security risks whereby unauthorized users can retrieve information or modify the given resources remotely. The basic security framework introduced in SNMPv3 only specifies the use of symmetric cryptography techniques to address the security concerns. This paper outlines a new methodology, public-key security model (PSM), to integrate public cryptography techniques into the SNMP framework. It extends the existing user-based security model (USM) to include per-session authentication and encryption keys, thus enhancing the security of the SNMPv3 protocol.

This paper presents an original Model-Driven-Engineering (MDE) approach to support the verification and testing of security properties in dynamic web applications. Based on a previously recovered UML-based fine-grained security model, the approach begins by transforming the model into a Prolog-based formal model. The Prolog model is then checked to verify whether the application conforms to specified access control security properties. We demonstrate the use of our method on the popular open source bulletin board system PhpBB 2.0, in the context of three test scenarios: testing for unauthorized access, web application security maintenance, and web application re-engineering.

SummaryThe growing use of SMS by businesses to communicate with their customers has made attackers more interested in smishing attacks. Smishing is a security attack that involves sending a fake SMS message in order to steal the personal credentials of mobile users. This kind of attack has become a serious cyber‐security issue and has caused great financial losses for both people and businesses. In this article we propose a hybrid security model called “SM‐Detector” aiming to detect smishing messages in mobile environments. To increase the efficiency of “SM‐Detector,” we have combined three different detection methods: (i) identification of malicious URLs, (ii) identification of suspected words, phone numbers and emails with regular expression analysis, and (iii) classification of messages using BERT‐based algorithms to distinguish spam messages. “SM‐Detector” also includes a mobile application allowing the user to check their SMS and report smishing messages. Its strength is that it can deal with mixed text messages written in Arabic or English. The experimental evaluation conducted on English and Arabic datasets showed a remarkable accuracy of 99.63%.

Analysis and design patterns are well established to build high-quality object-oriented software. Patterns combine experience and good practices to develop basic models that can be used for new designs. Security patterns join the extensive knowledge accumulated about security with the structure provided by patterns to provide guidelines for secure system design and evaluation. They are being adopted by companies such as IBM, Sun, and Microsoft. We show the anatomy of a security pattern, a variety of them, and their use in the construction of secure systems. These patterns include Authentication, Authorization, Role-based Access Control, Firewalls, Web Services Security (SAML, XACML, XML Firewall), and others. We apply these patterns through a secure system development method based on a hierarchical architecture whose layers define the scope of each security mechanism. First, the possible attacks are considered from an analysis of use cases. Then the rights of the users are defined from the use cases using a Role-Based Access Control (RBAC) or other security model. The attacks are used to define the policies that could stop them. The rights are reflected in the conceptual class model. We then define additional security constraints that apply to distribution, interfaces, and components. The patterns are shown using UML models and some examples are taken from my book “Security Patterns” (Wiley 2006).KeywordsSecure SystemSecurity ModelSecurity MechanismHierarchical ArchitectureSecurity PatternThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Rapidly identifying and mitigating security threats to reduce the impact of attacks is one of the most pressing challenges of our time. Digital threats frequently jeopardize users, often manifested as web-based, intranetwork, or spam-related attacks. The literature indicates that most studies examine each type of attack separately. This study introduces six distinct deep learning (DL) model architectures capable of detecting three attacks. The results of this study demonstrate that the Deep Neural Network (DNN) model achieved a test accuracy of 98.78% for the FWAF dataset. The CNN-LSTM model achieved 99.95% accuracy for the KDDCUP-99 dataset and 99.09% accuracy for the SMS Spam dataset. This study accurately identifies anomalous activities and anticipates potential attacks by analyzing large data sets from various data channels. Furthermore, this work improves the efficacy of existing firewalls and holds significant promise in preventing malicious factors from exploiting vulnerabilities in digital infrastructures. This study conducted experiments in a real-time environment using artificial intelligence models deployed on Jetson Nano. For malicious traffic detection, malicious traffic was created on the network with the Nmap tool, and network traffic was monitored using Wireshark, followed by classification using our model. In the Damn Vulnerable Web Application (DVWA) platform, a malicious URL classification model was used to test web attacks. For spam detection, suspicious text was retrieved from the user via a plugin running in the browser and sent to the spam classification model, and the result was returned to the user. In conclusion, DL models have the potential to detect and prevent various security threats in web applications. This study enables the analysis of normal operating behaviors in web applications and the identification of anomalous activities. This capability helps detect attempted intrusions or potential security issues indicating user behavior. Furthermore, the study facilitates the automatic detection of attacks targeting web applications and the implementation of countermeasures to mitigate such threats.