Information and Communication Technology (ICT) integrates multiple devices and applications that are connected directly to the Internet communications. The development of customer server systems in technology, such as IoT based, cloud based, and smart homes systems is growing rapidly in the current era of technology. User authentication is an important concern for these applications. THJWT i.e., Tuned Hybrid JSON Web Token for JWT-based properties has been particularly evident in the recent growth of client server requests. JWTs (JSON Web Token) are used for authentication of subsequent customer requests without making regular calls to a resource server or database. In this paper, we have introduced the process of authenticating and verifying JWT on each client request based on the random stamp values to verify client authentication on the server data. The effectiveness of the proposed approach is enhanced by case studies that demonstrate time and space complexity.
Security and privacy of user data is a prime concern in today's digital world. User authentication,
access to services and access time in terms of IoT, mobile, web and cloud-based applications [
IOT devices such as actuators, gadgets, sensors, radio frequency identification (RFID) tags, and communication technologies can be integrated together and a variety of physical entities and devices can be connected to the Internet to permit those objects to communicate with each other.
From Data Analysis to healthcare and manufacturing, IOT consists mostly of little materials that are provided with unique identifiers (UIDs) with the ability to send data over a network without requiring user to user or user to computer interaction. That is why, IOT is the backbone of a grand technological
2022 Copyright for this paper by its authors. future. IOT is getting major focus in almost every business sector and, it is a fact that it has already started having its influence on web app design & development. Further, due to COVID-19 our dependency on such systems has increased exponentially.
Although IOT devices have a lot of significance to our busy world but we need to the secure the data generating from these devices and must have a special check on the security of such devices. The binary data that is sent over these networks is always important and vulnerable to attack.
Thus, user data must be secured to protect the privacy and confidentiality of the registered user. If there is no check, then threats like data tempering, data breaching and theft of personal information can be there. Hence, some of the crucial terms associated with IOT security involve identification and authentication. The process of identifying a user as being the claimed/registered person is called user authentication. The server can provide different roles or privileges to various authorized users. But in IOT things are little different, there may be a case where a particular node may act as a client for one node and a server or Authentication Agent for some other, hence a better security system is required.
A web application (or “web app”) is an application that runs on any web browser and performs various tasks with the help of Internet. The user-facing component of an IOT system is called the interface of the application. The app may run on any Operating System such as IOS or Android which can be installed on a laptop, smartphone or a tablet. Data stored at the sever side is used for access and verification. However, checking the database server for every request would cause a serious performance bottleneck.
Old way of providing security is through methods which store a session on each client's machine (browser) with client authentication on the server. As long as the session is active, the client can send the request to access the server resources and server responses to the request using the session key. Time keys are assigned to clients on initial server request after verification of ownership from the database server. The client keeps the key assigned to the cookie for ongoing communication with the server. The client sends the same session key to the server for verification for each request. Sever will only look for a valid session key from the client for client authentication instead of asking for details again. The weakness of this machine is to easily hijack session keys by attackers. Hackers may use various tools to identify a malicious power session and gain access to current user sessions. Various extensions, tools and plugins can be used to transfer cookie and key information to third-party applications. 2.2
OAuth is a protocol which can grant one application the credentials it requires to access data and information in another application through a web service. Web services allows SOAP to provide a robust programming model that helps in the following manner:
The SOAP (Simple Object Access Protocol) is a messaging protocol specification which is based on XML to encode requests and responses in case of a web service. It can be used to handle the following scenarios: 1. Calling a method on a service. 2. To get a response from a service method, and handling its return value and out parameters. 3. Handling errors.
Limitations of SOAP: SOAP can only work on XML data, this is one of the biggest reasons why a SOAP API will be less effective, as XML is a verbose and heavy format compared to JavaScript Object Notations (JSON data). In case of SOAP, API calls made to your server will require more network resources such as bandwidth and heavy processing which will take more time to authenticate the client. In SOAP, tight coupling is implemented as the client-server communication depends on WSDL (Web Service Description Language) contracts. Therefore, SOAP is not recommended for applications which are loosely coupled. SOAP is harder to code, and can’t be tested in the web browser (as opposed to REST where we have response codes). Further it is very difficult to make contracts in WSDL, create client stubs as it follows strict behavior. 2.3
The JSON Web Token (JWT) is a secure way of representing a collection of information between two parties. JWT has been used in various applications to maintain customer authentication while communicating with the server. Various development tools and frameworks such as Passport, OpenID Connect, Django REST framework, DNN, Arengu, etc have integrated support for JWT. JWT offers various methods through which we can authenticate a user and a token can be used to access the server resources. These methods can be misused by attackers to gain access to server resources.
In this paper, we present a focused approach for detecting and accessing a server resource with a JWT predictor attack during client-server interaction and distinguishing between valid and invalid customer requests after a user's registered credentials are not matching. A case study is conducted in which a new JWT is developed based on each client request containing either a combination of token with an authorized unique key which can be a registered username or password. This proposed approach contributes to eliminating JWT predictors by attackers. JWT defines a secure way to transmit information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. Here is how it works:
A JSON Web Token consists of a header section, payload section, and a signature section in base64url encoding, separated by dots (periods), given as follows: HEADER.PAYLOAD. SIGNATURE
This is how a JWT actually looks like: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiSm9obiBEb2UiLCJ1c2VX25hbWUiOiJqb2huLm RvZSIsImlzX2FkbWluIjpmYWxzZX0.fSppjHFaqlNcpK1Q8VudRD84YIuhqFfA67XkLam0_aY 1. The header contains metadata about the token, such as the algorithm used for the signature and the type of the token (which is simply JWT). For this example, the header before encoding is: { }
"alg": "HS256","typ": "JWT“ 2. The payload contains information (claims) about the entity (user) that is going to be verified by the application. Our sample token includes the following claims: "is_admin": false } 3. Finally, to generate the signature, we have to apply base64url encoding and sign the whole thing using a secret (for symmetric encryption) or a private key (for asymmetric encryption), depending on the algorithm specified in the header. We can use any algorithm like SHA256 in the header, which is a symmetric algorithm, so the encoding and signing operation would be:
HMACSHA256(base64UrlEncode(header) + "." +base64UrlEncode(payload), secret) This gives us the following signature, which is then appended (after a dot) to the base64url-encoded headerand payload:
fSppjHFaqlNcpK1Q8VudRD84YIuhqFfA67XkLam0_aY
Generally, a server uses same JWT for the all requests until user logs out from system. There is a need to propose a generalized solution for all type of applications. The generalized solution should secure JWT to eliminate vulnerability in client authentication. Hence, we are proposing the same as follows:
HMAC using SHA-384 HMAC using SHA-512 RSASSA-PKCS1-v1_5 using SHA-256 RSASSA-PKCS1-v1_5 using SHA-384 RSASSA-PKCS1-v1_5 using SHA-512 ECDSA using P-256 and SHA-256 ECDSA using P-384 and SHA-384 ECDSA using P-521 and SHA-512 RSASSA-PSS using SHA-256 and MGF1 with SHA-256 RSASSA-PSS using SHA-384 and MGF1 with SHA-384 RSASSA-PSS using SHA-512 and MGF1 with SHA-512
1. Any change in the user role causes a significant value loss after the allocating the token to client.
It can be hacked to exploit the permissions user was given in the first attempt. A resource on server should be secure and must not be accessible to the unauthorized users or the users whose permissions are revoked. 2. Access token or the JWT remains same in most of the cases (get/post/put request and response) happening between client and server interaction. Attacker can predict this vulnerability and can temper the JWT.
The following steps can be used to authenticate client on a server through JWT: • • • •
The client will send an authentication request by credentials, such as a username– password combination for login.
After a valid login, the authentication service will create a JWT with a secret key. This secret key can be a combination of username or any other registered attribute.
The client uses this token with the request to a secured resource on server.
When the server receives the request from client again, it checks the user authentication from JWT for reorganization of authentic request along with a check on the secret key. Server will send a proper response based on valid or invalid token.
The key feature of JWT is that it allows for flexibility in communication, so the client cannot change the details contained in the token. On the other hand, if the user role is updated it will be displayed or predictedby the server for any vulnerability in the next application. Under normal circumstances, clients cannot force you to forget an old JWT token and use a new token.
With every new THJWT (Tuned Hybrid JSON Web Token) for each resource request with an authenticatedidentity just to make things harder to predict for the attacker, So, let us assume T is the token and `T is the combination of Token and unique identity value. When the signature and secret key combination is calculated it will always generate a unique random-access token (JWT). This token will be returned to the client in response to each client's request.
Here are the steps, that will enhance the authenticity of a client on sever:
Step 2: Server receives a request and verifies the credentials from server. If credentials are verified, then go to step 3 otherwise the control moves to step1.
Step 3: Server generates JWT by combining a value (it may be any registered user credential). T=token,T’=token+ (Unique registered credential, can be username) Step 4: Server will receive a request from client with T’ (Token + Unique registered username). Step 5: Server will check the token information first if it is not valid, then return Response Code401(Unauthorized Token) else move to 6.
Step 6: Server will check the unique registered username if it is not valid-return response code401(Unauthorized user). If both 5 & 6 are valid it will move to Step-7 else to Step-1.
Step 7: Server will allocate or provide the resources as per request.
•
Server will generate trigger for JWT token with the Help of login credentials (Username and password) and type of token method. •
Request to resources with the help of generated JWT token.
We add the JWT token to the request with the help of the authentication tool.
Request to resource with JWT token in the request and it will return 401 (Unauthorized). Request to resources with the help of JWT token and invalid user name, this will result in 401 (Unauthorized)
19 • •
Request resources with wrong JWT and correct unique this will result in name, 401 (Unauthorized) Request to resource with correct JWT and correct unique username. This will result in 200 (Ok, Authorized) and you will get the requested resources.
A mobile application is developed to find out the algorithm performance on HTJWT. We have tested the scenario with 50 times the process, starting from testing the time to generate the token, the size of the token generated, encrypting it and finally the data transfer speed of the token from the client request to the server until the token response is received by the client.
If we compare the performance of all the algorithms used, we can see that the HMACSHA-256 algorithm is superior to an average response time of 8.6ms and size 563bytes when compared to HMACSHA-384 while with HMACSHA-512.
In this study, we have presented an enhancement in the JWT access control solutions for different applications developed on the platforms, such as mobile apps and cloud systems. Creation of new tokens on every client request on server can resist attacker to identify the signature of a client. We have implemented a technique which can be used by application developers for securing the server resources from revoked permissions and unauthenticated requests.
The results are explained with the comparison of token- based authentication performance using JWT with several algorithms. The overall results show that the use of THJWT with HMACSHA-256 signature is superior in case of time taken to generate token, token size and token transfer speed.
We can implement various user roles and authorize them to access specific resources according to the need of the overall application. Further we can test our system (mobile application) for various types of cross scripting attacks such as None Algorithm attack, signature stripping, manipulating Kid (Key Identifier), SQL injection, etc.
[18] Korzun D G, Balandin S I, and Gurtov A V, Deployment of Smart Spaces in Internet of Things: Overview of the Design Challenges (Lecture Notes in Computer Science), vol.8121. New York, NY, USA: Springer, 2013. [19] Chen Y and Luo B, “S2A: Secure smart household appliances,” in Proc. 2nd ACM Conf. Data Appl.
Secur. Privacy (CODASPY), 2012, pp. 217–228. [20] Li, “Design Y of a key establishment protocol for smart home energy management system,” in Proc.
5th Int. Conf. Comput. Intell., Commun. Syst. Netw. (CICSyN), Jun. 2013, pp. 88–93. [21] Vaidya B, Makrakis D, and Mouftah H T, “Device authentication mechanism for smart energy home area networks,” in Proc. IEEE Int. Conf. Consum. Electron. (ICCE), Jan. 2011, pp. 7