A session is a period of time linked to a user, which is initiated when he/she arrives at a web application and it ends when his/her browser is closed or after a certain time of inactivity. Attackers can hijack a user's session by exploiting session management vulnerabilities by means of session fixation and cross-site request forgery attacks.
Very often, session IDs are not only identification tokens, but also authenticators. This means that upon login, users are authenticated based on their credentials (e.g., usernames/passwords or digital certificates) and issued session IDs that will effectively serve as temporary static passwords for accessing their sessions. This makes session IDs a very appealing target for attackers. In many cases, an attacker who manages to obtain a valid ID of user’s session can use it to directly enter that session – often without arising user’s suspicion. A secure session management must be implemented in the development phase of web applications because it is the responsibility of the web application, and not the underlying web server.
Threat modeling is a systematic process that is used to identify threats and vulnerabilities in software and has become popular technique to help system designers think about the security threats that their system might face.
In this paper we design the threat modeling for session’s ID threat by using SeaMonster security modeling software, and then propose a secure session management that avoids the vulnerabilities. The proposed secure session management is designed to give trust authentication between the client and the server to avoid session hijacing attack by using both: server session’s ID and MAC address of the client.Visual Studio. Net 2008 is used in implementing the proposed system
As smartphones incorporate location data, there is a growing concern about location privacy as smartphone technologies advance. Using a remote server, the mobile applications are able to capture the current location coordinates at any time and store them. The client awards authorization to an outsider. The outsider can gain admittance to area information on the worker by JSON Web Token (JWT). Protection is giving cover to clients, access control, and secure information stockpiling. Encryption guarantees the security of the location area on the remote server using the Rivest Shamir Adleman (RSA) algorithm. This paper introduced two utilizations of cell phones (tokens, and location). The principal application can give area inf
... Show More
(1)
In recent years, the rapid development in the field of wireless technologies led to the appearance of a new topic, known as the Internet of things (IoT). The IoT applications can be found in various fields of our life, such as smart home, health care, smart building, and etc. In all these applications, the data collected from the real world are transmitted through the Internet; therefore, these data have become a target of many attacks and hackers. Hence, a secure communication must be provided to protect the transmitted data from unauthorized access. This paper focuses on designing a secure IoT system to protect the sensing data. In this system, the security is provided by the use of Lightweight AES encryption algorithm to encrypt the d
... Show More
(17)
(3)
The Internet provides business with new methods of reaching and interacting with ·customers as well as improving inter and intra business communication.
In this research, a soft.ware marketing web site with a security
tools is designed and implemented to protect the customer pers.onal information and payment information when a customer tries to pay a software package.
A new protectior.t method is suggested to protect  
... Show MoreThe contemporary role of administrative accounting Renewal or threat
The need to exchange large amounts of real-time data is constantly increasing in wireless communication. While traditional radio transceivers are not cost-effective and their components should be integrated, software-defined radio (SDR) ones have opened up a new class of wireless technologies with high security. This study aims to design an SDR transceiver was built using one type of modulation, which is 16 QAM, and adding a security subsystem using one type of chaos map, which is a logistic map, because it is a very simple nonlinear dynamical equations that generate a random key and EXCLUSIVE OR with the originally transmitted data to protect data through the transmission. At th
... Show More
Modeling data acquisition systems (DASs) can support the vehicle industry in the development and design of sophisticated driver assistance systems. Modeling DASs on the basis of multiple criteria is considered as a multicriteria decision-making (MCDM) problem. Although literature reviews have provided models for DASs, the issue of imprecise, unclear, and ambiguous information remains unresolved. Compared with existing MCDM methods, the robustness of the fuzzy decision by opinion score method II (FDOSM II) and fuzzy weighted with zero inconsistency II (FWZIC II) is demonstrated for modeling the DASs. However, these methods are implemented in an intuitionistic fuzzy set environment that restricts the ability of experts to provide mem
... Show More
(8)
(6)
An intelligent software defined network (ISDN) based on an intelligent controller can manage and control the network in a remarkable way. In this article, a methodology is proposed to estimate the packet flow at the sensing plane in the software defined network-Internet of Things based on a partial recurrent spike neural network (PRSNN) congestion controller, to predict the next step ahead of packet flow and thus, reduce the congestion that may occur. That is, the proposed model (spike ISDN-IoT) is enhanced with a congestion controller. This controller works as a proactive controller in the proposed model. In addition, we propose another intelligent clustering controller based on an artificial neural network, which operates as a reactive co
... Show More
(14)
(13)
The Elliptic Curve Cryptography (ECC) algorithm meets the requirements for multimedia encryption since the encipher operation of the ECC algorithm is applied at points only and that offer significant computational advantages. The encoding/decoding operations for converting the text message into points on the curve and vice versa are not always considered a simple process. In this paper, a new mapping method has been investigated for converting the text message into a point on the curve or point to a text message in an efficient and secure manner; it depends on the repeated values in coordinate to establish a lookup table for encoding/ decoding operations. The proposed method for mapping process is&
... Show More
(3)
(2)