Design and Implementation of a Secure Scheme for the C/S Mode E-Government System

Feng, Zuo-Hua; Zhu, Yanjie

doi:10.1109/etcs.2010.106

Cited by 1 publication

(7 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another similar work in the same year was proposed by Feng [15], but instead of a centralised CA and a directorymanaged escrow, a client-server architecture was proposed to authenticate and validate users. In this architecture, users are required to provide a certificate to prove identity along with their private key.…”

Section: Previous Similar Workmentioning

confidence: 96%

“…Furthermore, even though they provide session control based on access requests [2] [15], there is no way of preventing unauthorised access to the backend using the proposed models, unless audit trails are set on the database, and direct login requests to the back-end are detected.…”

Section: Previous Similar Workmentioning

confidence: 97%

“…In conclusion, considering the restrictions in adopting a directory-like structure for access control on eGovernment services, and the limitations regarding certificate management for every citizen, both certificate-based access control models for authentication [2] [15] are not scalable. Moreover, none of the proposed models solves the lack of evidence and audit trails in databases that are accessed without authorisation, which hinders the possibility to carry out effective digital investigations.…”

Section: Previous Similar Workmentioning

confidence: 98%

“…As analysed in section II, the Client-Server model proposed by Feng [15] provides access control based on two elements of authentication: the user certificate and the private key. Considering that, in PKI, key management involves distribution and revocation [17], the latter is simple as any compromised key needs to be revoked once from the directory and the escrow.…”

Section: A Salting-based Authentication Module (Sam)mentioning

confidence: 99%

“…Hence, credentials in transit over the Internet are protected during SSL Handshake. 2) A centralised Authentication Service (AS): deployed into a SSL protected Web Server to provide one entry point for user registration and user authentication, as suggested by Zhong [2] and Feng [15]. However, a security measure is implemented using an algorithm for adding a salt to the password [19] before hashing and storing it [20] into the Application Database Server.…”

Section: A Salting-based Authentication Module (Sam)mentioning

confidence: 99%

See 4 more Smart Citations

An authentication and auditing architecture for enhancing security on egovernment services

Flores

2014

2014 First International Conference on eDemocracy &Amp; eGovernment (ICEDEG)

View full text Add to dashboard Cite

eGovernment deploys governmental information and services for citizens and general society. As the Internet is being used as underlying platform for information exchange, these services are exposed to data tampering and unauthorised access as main threats against citizen privacy. These issues have been usually tackled by applying controls at application level, making authentication stronger and protecting credentials in transit using digital certificates. However, these efforts to enhance security on governmental web sites have been only focused on what malicious users can do from the outside, and not in what insiders can do to alter data straight on the databases. In fact, the lack of security controls at back-end level hinders every effort to find evidence and investigate events related to credential misuse and data tampering. Moreover, even though attackers can be found and prosecuted, there is no evidence and audit trails on the databases to link illegal activities with identities. In this article, a Salting-Based Authentication Module and a Database Intrusion Detection Module are proposed as enhancements to eGovernment security to provide better authentication and auditing controls.

show abstract

Section: Previous Similar Workmentioning

confidence: 96%

Section: Previous Similar Workmentioning

confidence: 97%