World Academy of Science, Engineering and Technology
Published December 27, 2007 | Version 9559
Journal article Open

A Novel Security Framework for the Web System

Authors/Creators

Description

In this paper, a framework is presented trying to make the most secure web system out of the available generic and web security technology which can be used as a guideline for organizations building their web sites. The framework is designed to provide necessary security services, to address the known security threats, and to provide some cover to other security problems especially unknown threats. The requirements for the design are discussed which guided us to the design of secure web system. The designed security framework is then simulated and various quality of service (QoS) metrics are calculated to measure the performance of this system.

Files

9559.pdf

Files (9.3 MB)

Name Size Download all
md5:33f91396bca9b95638781ac4abe14e25
9.3 MB Preview Download

Additional details

References

  • Netcraft, "Netcraft Web Server Survey," 2005. Available http://www.netcraft.com/survey
  • D. Hanson, "ARIS Top Ten 2005 Threats," Security Focus, 2005. Available http://www.securityfocus.com/corporate/research.
  • R. Power, "CSI/FBI Computer Crime and Security Survey," Computer Security Issues & Trends, vol. 8, no.1, 2002.
  • AusCERT, "Australian Computer Crime and Security Survey," 2002. Available http://www.auscert.org.au.
  • Microsoft, "E-Commerce Security," 2000. Available microsoft.com/technet/itsolutions/ecommerce/maintain/operate/ecomsec. asp
  • L. Ganci, "Firewall and Network Configuration," Websphere Commerce V5.4 Handbook, Architecture and Integration Guide, Appendix A, IBM Redbooks, 2002, p. 790.
  • Oracle, "Deploying CRM Applications on the ECO Structure Architecture," 2001. Available http://www.eecostructure.com/crmwp.pdf
  • R. Zalenski, "Firewall Technologies," IEEE Potentials, vol. 21, no. 1, 2002, pp. 24-29.
  • AusCERT, Windows NT Configuration Guidelines, 2002. Available http://www.auscert.org.au/render.html?it=1970&cid=1920. [10] AusCERT, UNIX Security Checklist, v2.0, 2001. Available http://www.auscert.org.au/render.html?it=1935&cid=1920. [11] R. Sandhu and S. Samarati, "Authentication, Access Control, and Audit," ACM Computing Surveys, vol. 28, no. 1, 1996, pp. 241-243. [12] J. Ellis and T. Speed, The Internet Security Guidebook: from Planning to Deployment. San Diego: Academic Press, 2001. [13] R. Duncan, "An Overview of Different Authentication Methods and Protocols", 2001, unpublished. Available http://rr.sans.org/authentic/overview.php [14] E. Spafford, "Observing Reusable Password Choices," UNIX Security Symposium III Proceedings, 1992. [15] J. Franks, "RFC-2617 HTTP Authentication: Basic and Digest Access Authentication," 1999, unpublished. [16] K. Fu, "Dos and Don'ts of Client Authentication on the Web," Proceedings of the 10th USENIX Security Symposium, 2001. [17] S. Hada and H. Maruyama, "Session Authentication Protocol for Web Services," Proceedings Symposium on Applications and the Internet Workshops, Nara, Japan, 2002. [18] T. Verschure, "Smart Access: Strong Authentication on the Web, Computer Networks and ISDN Systems, vol. 30, 1998, pp. 1511-1519. [19] J. Joshi, "Security Models for Web-Based Applications," Communications of the ACM, vol. 44, no.2, 2001, pp. 38-44. [20] J. Park, R. Sandhu, and A. Joon, "Role-Based Access Control on the Web," ACM Transactions on Information and Systems Security, vol. 4, no. 1, 2001, pp. 37-71. [21] Publications and Web Services OWASP, A Guide to Building Secure Web Applications, 2001. Available http://www.owasp.org/ [22] R. Peteanu, Best Practices for Secure Development, 2001. Available http://members.rogers.com/razvan.peteanu