JSON Web Token Research Articles

Studying the security of web services USING JSON web Token with RSA-512 algorithm and comparative analysis of HMAC-HA512, HMAC-256 AND RSA-512 for signing json web token

Studying the security of web services USING JSON web Token with RSA-512 algorithm and comparative analysis of HMAC-HA512, HMAC-256 AND RSA-512 for signing json web token

BEFF-SIGS: blockchain-enhanced fog framework- securing IoT data integrity and green sustainability through scalable authentication-authorization

This paper introduces a comprehensive framework designed to address security concerns in the Internet of Things (IoT) environment while contributing to the global Green Environment Initiative. The proposed mechanism utilizes a secure and scalable Authentication-Authorization system, employing JSON Web Token (JWT) and Casbin to ensure that only authorized entities access critical data. Data processing is strategically offloaded to the fog layer to enhance scalability and reduce latency, optimizing IoT data handling. The framework actively supports environmental sustainability by promoting eco-friendly practices within industrial setups. Industries are incentivized to embrace environmentally responsible approaches through tax incentives, fostering a greener future. Our model is a robust mechanism to guarantee the consistency and authenticity of the data stored in the cloud environment, offering assurance against potential tampering attempts by securing data integrity. This holistic approach demonstrates how governments can leverage cutting-edge technology to incentivize industries and promote a sustainable and eco-friendly future. Utilizing blockchain technology ensures unparalleled transparency, robust security, and tamper-resistant record-keeping. We evaluate the impact on network consumption, latency, and energy consumption for analyzing the performance of the proposed system. The proposed framework offers better latency, network efficiency, and distributed computational power as major benefits over depending exclusively on cloud resources in IoT deployments.

FastAPI vs. The Competition: A Security Feature Showdown with a Proposed Model for Enhanced Protection

API security is of paramount importance in modern web applications, as it protects sensitive data and ensures authorized access to resources. FastAPI, a Python-based web framework, offers various security features to developers for building secure APIs. This paper examines the security features provided as well as supported by FastAPI, The provided features consists of OAuth2 authentication, Dependency injection and Security Schemas and Scopes, whereas the supported security features includes Json Web Token (JWT) authentication, Cross Site Request Forgery (CSRF) token support and HTTPS support. The supported features can be implemented by using python libraries and middlewares. The proposed model combines the JWT token authentication, OAuth2 authentication, and Security Scopes and schema security features to enhance the security in the FastAPI application. The proposed model defines scopes for users and uses JWT to generate tokens and using OAuth2 authentication service to only allow a user who has the specific permissions and scopes to access and perform actions in the scope specific API endpoints. The model hence allows secure and safe working of applications by eliminating the threat of unauthorized users to corrupt the application code. The focus on performance and security makes FastAPI an excellent choice for developers seeking to build secure APIs. Overall, this paper highlights the importance of API security and showcases FastAPI's security features, demonstrating how developers can leverage FastAPI to build robust, performant, and secure APIs. Key Words: FastAPI, Flask, Django, OAuth2, JWT (JSON Web Token), CSRF (Cross Site Request Forgery)

Implementasi Single Sign-On Menggunakan Protokol Openid Connect (OIDC) Pada Virtual Private Server (VPS)

Single Sign-On (SSO) is an authentication method that allows users to access multiple website services using one account and one login process. OpenID Connect (OIDC) is a protocol based on OAuth 2.0 and provides user identity information through JWT (JSON Web Token) tokens. Virtual Private Server (VPS) is a service that can be configured according to user needs. Internet users have many accounts needed to access various online services such as email, social media, online shopping, and many more. Each online service usually has a different username and password. Users often find it difficult to remember each password needed. In addition, using the same password on each online service is also not recommended because it can increase security risks. Based on this problem, an SSO system is needed that is useful for helping users in logging in. The SSO system will be tested with two Dummy Students and Dummy Elearning clients using Black Box Testing with the Equivalence Partitioning technique. From the test results, it was obtained that the SSO system showed that 83% of the test scenarios were successfully carried out

Comprehensive Empirical Study of Python JWT Libraries

JSON Web Token (JWT) is a simple, compact way to share claims in a space-constrained environment. JWT is part of the interoperable JSON-based identity suite. Many libraries that provide JWT-based authentication and authorization exist. While the JWT standard is secure, some implementations still need to be made. This research paper delves into a comprehensive analysis of the prominent Python libraries utilized for JWT authentication. By meticulously examining these libraries, we aim to provide an in-depth understanding of their features and capabilities. Our investigation encompasses an enumeration of the distinct signing algorithms that are supported by each of these JWT Python libraries.To ensure the robustness and security of these libraries, we employ a multifaceted approach that utilizes various statistical application Security Testing (SAST) tools. These tools play a pivotal role in our assessment by not only evaluating the adherence of the codebase to the PEP8 standard but also by meticulously scanning for common security vulnerabilities and bugs that could potentially compromise the integrity of the authentication process.Our research goes beyond mere identification; we meticulously analyze each warning generated by the SAST tools, emphasizing those warnings that hold the most tremendous significance regarding potential security risks. Furthermore, our investigation extends to gauging the popularity and adoption of each library. To achieve this, we leverage GitHub statistics and harness the power of the Sourcegraph code search utility. By delving into these metrics, we gain a comprehensive view of the community’s engagement, usage trends, and overall traction of each library. In summary, this paper thoroughly explores the landscape of JWT authentication in Python, encompassing library evaluation, security assessment, warning analysis, and popularity metrics.

Securing Salesforce Integrations with JWT Authentication and OAuth 2.0: A Comprehensive Approach to Real-Time Data Protection

Real-time data exchange is the heart of interactions between systems involved in business processes today. Data from various Salesforce organizations is integrated with external systems. Protecting these interactions as these systems are integrated is of utmost importance. In this paper, we will discuss how to easily implement JWT authentication and OAuth 2.0 integration in Salesforce to protect these exchanges. JWT (JSON Web Token) authentication and Oauth are excellent secure approaches to integrating systems rapidly in real time. They also add another layer of security to your integration process by ensuring you make the call from the intended system. This paper will show a detailed integration flow with screen prints and explanations for incorporating JWT and Oauth in Salesforce. We will also explore various security changes and how they can help any business, ultimately improving the Salesforce integration process.

Transitioning GlideinWMS, a multi domain distributed workload manager, from GSI proxies to tokens and other granular credentials

GlideinWMS is a distributed workload manager that has been used in production for many years to provision resources for experiments like CERN’s CMS, many Neutrino experiments, and the OSG. Its security model was based mainly on GSI (Grid Security Infrastructure), using X.509 certificate proxies and VOMS (Virtual Organization Membership Service) extensions. Even when other credentials, like SSH keys, were used to authenticate with resources, proxies were also added all the time, to establish the identity of the requestor and the associated memberships or privileges. This single credential was used for everything and was, often implicitly, forwarded wherever needed. The addition of identity and access tokens and the phase-out of GSI forced us to reconsider the security model of GlideinWMS, to handle multiple credentials which can differ in type, technology, and functionality. Both identity tokens and access tokens are supported. GSI proxies even if no more mandatory, are still used, together with various JWT (JSON Web Token) based tokens and other certificates. The functionality of the credentials, defined by issuer, audience, and scope, also differ: a credential can allow access to a computing resource, or can protect the GlideinWMS framework from tampering, or can grant read or write access to storage, can provide an identity for accounting or auditing, or can provide a combination of any the formers. Furthermore, the tools in use do not include automatic forwarding and renewal of the new credentials so credential lifetime and renewal requirements became part of the discussion as well. In this paper, we will present how GlideinWMS was able to change its design and code to respond to all these changes.

POSIX access to remote storage via OpenID Connect

INFN-CNAF is one of the Worldwide Large Hadron Collider Computing Grid (WLCG) Tier-1 data centers, providing support in terms of computing, networking, storage resources and services also to a wide variety of scientific collaborations, ranging from physics to bioinformatics and industrial engineering [1]. Recently, several collaborations working with our data center have developed computing and data management workflows that require access to S3 storage services and/or the integration with POSIX capabilities. Nevertheless, the access to the data must be regulated by federated authentication and authorization mechanisms, such as OpenID Connect (OIDC), which is largely adopted by communities like WLCG [2] and within the European Open Science Cloud (EOSC) [3]. In the present work, the possibility to regulate POSIX access by integrating JSON Web Token (JWT) [4] authentication, provided by INDIGO-IAM as Identity Provider [5], with solutions based on S3 (for object storage) and WebDAV (for hierarchical storage) protocols has been evaluated an related results have been reported. In such respect, a comparison between the performance yielded by S3 and WebDAV protocols has been carried out within the same distributed environment with the aim to better identify the solution most suitable for the different use cases.

BJWT-EHR: A novel JWT based Blockchain System for Electronic Health Records

Since most transactions in the world now take place digitally, it is crucial to maintain data integrity, share data securely, and provide quick access to it. Our reliance on computers in our daily lives is growing, and new data will inevitably be generated to meet this need. Providing for safe data exchange is becoming increasingly crucial every day. Maintaining and safeguarding the security of this data is crucial. Recently, the term "blockchain" has been used extensively for data security. A decentralized digital ledger called blockchain is in charge of preserving data integrity and facilitating safe data sharing. Blockchain transfers data by the principle of transparency, records data one way, and prevents reverse engineering. According to reports, blockchain is the general term for the technology that promotes common data sharing of these recorded data and reduces access times, essential for preserving data security. There are several risks to patients' privacy when information from medical records is stolen or altered. The damage caused by malicious people with this information causes serious harm to both the patient and the financing institution. Therefore, cloud-based EHR (electronic health records) is becoming a focal point in many areas. Storing patient data, ensuring data accuracy, protecting data confidentiality, and ensuring fast data transmission in the cloud system is a significant concerns in the healthcare industry. In this study, the layered architecture structure is also addressed in addition to the blockchain for sharing health data with the help of cloud service providers while providing data access control and auditing for EHR records. To enter this layered architectural system, new solutions are proposed by applying JWT (JSON web token) and hashing function of patient information. This proposed method manages and controls the patient's health records electronically. Therefore, these technologies used in the blockchain platform open new doors to more secure and sustainable solutions.

Restful API Security Using JSON Web Token (JWT) With HMAC-Sha512 Algorithm in Session Management


 
 
 
 Information systems are technologies that can help work systematically. However, the existing systems or applications are not yet integrated with one another, making many processes have the same function on different systems, for example the authentication process is built using the web service concept. Integration or interoperability of information system software involving various components, which may create gaps that can disrupt system security. In this study, security has been implemented in web services using JSON Web Token (JWT) with the HMAC-SHA512 algorithm which is stored in browser cookies. From the research results, this concept is very suitable to be applied to applications or information systems on different platforms that use the same service, JWT tokens are also successfully stored in browser cookies. In addition, a comparison was also made between the HMAC-SHA512 and HMACSHA-256 algorithms and in the final result it was found that the total time difference was 185 ms and the average time difference was 6.17 ms. It can be concluded that the HMAC-SHA512 algorithm is 0.9861% faster than the HMAC-SHA256 algorithm.
 
 
 

Enhancing Data Security: A Comprehensive Study on the Efficacy of JSON Web Token (JWT) and HMAC SHA-256 Algorithm for Web Application Security

In today's digital era, data security is a very important aspect in various applications and services. In order to protect the integrity, confidentiality and authentication of data, security technologies such as JSON Web Token (JWT) and HMAC SHA256 algorithm are widely used. JWT is an open standard (RFC 7519) that is used to represent information in the form of tokens that can be signed digitally. The research methodology used in this research is a descriptive research method. The descriptive method is a method that describes the purpose of the data collected and records every aspect of the situation being investigated to get a clear picture of what is needed. It was found that there were several data leaks when data security was not implemented in layers, including cases that had occurred such as loss of important data contained in the website and leaks of important data which caused identities to be spread widely. Conclusions from the use of JSON Web Token (JWT) and HMAC-SHA-256 algorithm for website security is that this combination provides a strong layer of protection against security threats that are common in the online environment.

IMPLEMENTASI API RESTFUL DENGAN JSON WEB TOKEN (JWT) PADA APLIKASI E-COMMERCE THRIFTY SHOP UNTUK OTENTIKASI DAN OTORISASI PENGGUNA

User authentication and authorization play a vital role in securing sensitive data within applications. E-commerce applications, in particular, require robust authentication and authorization methods to safeguard the confidentiality and integrity of exchanged data. JSON Web Token (JWT) has emerged as a popular authentication mechanism for securing data transmission over networks. This paper explores the implementation of JWT in a RESTful API to achieve user authentication and authorization in an E-commerce application. The objective of this study is to analyze the implementation of JWT in a RESTful API for user authentication and authorization within an E-commerce context. The detailed implementation of JWT in the Thrifty Shop application is discussed, encompassing its utilization for user authentication and authorization. Additionally, the benefits derived from employing JWT in the Thrifty Shop E-commerce application are explored. In conclusion, the implementation of JSON Web Token (JWT) in a RESTful API proves to be an effective approach for user authentication and authorization in E-commerce applications. The use of JWT ensures that only authenticated users gain access to sensitive data, thus enhancing the security of the Thrifty Shop E-commerce application. This implementation can serve as a model for other E-commerce applications seeking to bolster their security measures.

Scalable and Secure Virtualization of HSM With ScaleTrust

Hardware security modules (HSMs) have been utilized as a trustworthy foundation for cloud services. Unfortunately, existing systems using HSMs fail to meet multi-tenant scalability arising from the emerging trends such as microservices, which utilize frequent cryptographic operations. As an alternative, cloud vendors provide HSMs as a service. However, such cloud-managed HSM usage models raise security concerns due to their untrusted and shared operating environment. We propose ScaleTrust, a scalable and secure system for key management. ScaleTrust allows us to scale the number of virtual HSM partitions, each of which is isolated with respect to each other and is robust against cloud insider attacks, while preserving physical isolation of the root of trust. To enable this, ScaleTrust uses Intel SGX and multiple HSM features, such as restricting key usage by controlling key attributes of in-HSM keys and establishing a secure channel using only HSM commands. Finally, we apply ScaleTrust to four real-world systems: Keyless SSL for TLS private key offloading, JSON Web Token authentication for microservices, key provisioning, and encryption in database systems. Our evaluation shows that ScaleTrust achieves multi-tenancy in a scalable way by providing multiple virtual HSMs with legacy HSM devices that are designed to support a single tenant. ScaleTrust provides security against insider threats while incurring 11.9% and 39.0% of end-to-end throughput and latency overhead for Keyless SSL compared to stand-alone HSMs.

JSON Web Token Leakage Avoidance Using Token Split and Concatenate in RSA256

This research aims to protect users from JWT (JSON Web Token) leakage, which is listed plainly in the Response Header in the web browser console. The risk of malicious attackers stealing the JWT is highly dangerous since the API (Application Programming Interface) will be within the control of malicious attackers, leading to identity theft and data abuse due to the JWT leakage. As a solution, this paper proposed a method in which the JWT bearer token will be split, separately encrypted by RSA256, and concatenated into a new unique token to limit attacker accessibility towards the JWT token. The benefit of this proposed method is envisaged to achieve a more secure web application for user data protection and security optimization. The idea of this method is to modify the bearer token by splitting, encrypting, and concatenating it to be a unique token. The product of the encryption process is an unrecognizable token in the form of letters and punctuation which attackers cannot manipulate. The encrypted code will be returned to the initial location in Response Header. After testing, it is proven that modifying the bearer token by splitting and concatenating provides more security to a web application.

Black Spot Area Alert Notification System

Abstract: Road safety is a major concern in the present situation. With increase in traffic volume across the globe resulting in higher road accidents which considerably cause negative impact on economic growth, then after this traffic safety become a major concern. It is found that road accident happening are more frequent at certain specific locations i.e blackspot. An accident blackspot is a zone where road accidents have been historically reported. This paper gives the design and paradigm of a GPS based web application. Adding to an idea, we use Nodejs and express Authorization json web token on the Fatal Accident dataset to address this problem. API Map Live is popular technique that identifies the accident-prone areas. In this project, we develop a web application by using React through which traveller came to know the upcoming blackspot notification before 500m and notify the traveller. For small scope we will provide dataset of Blackspots in Uttar Pradesh taken from officially government website (north.gov.in). The conclusive goal is to identify blackspot and notify the traveller by providing safety guidelines

Seamless Security on Mobile Devices Textual Password Quantification Model Based Usability Evaluation of Secure Rotary Entry Pad Authentication

Mobile devices are vulnerable to shoulder surfing and smudge attacks, which should occur when a user enters a PIN for authentication purposes. This attack can be avoided by implementing a rotary entry pad mechanism. Despite this, several studies have found that using a rotary entry pad reduces user usability. This study uses a Design Research Methodology approach. It will implement a rotary entry pad authentication in the Android operating system as an authentication method to protect the device against Shoulder Surfing Attacks and Smudge Attacks. Furthermore, it combined JSON Web Token (JWT) to secure the authentication process from the client to the server. At the end of implementation, it compared with other studies in terms of usability and evaluated it using the TQ-Model, which showed that the usability aspect has improved. Regarding security, we conducted a shoulder surfing attack simulation to assess the efficacy of guessing PINs. The results showed that only a limited number of attempts were successful, with two out of five samples failing to guess any numbers and only one sample successfully guessing six 10-digit PIN combinations out of 10 to the power of 10. The security test results show that shoulder surfing attacks are more difficult to perform after implementing the rotary entry pad. The evaluation showed that the JSpinpad performed better, with seven parameters showing improvement, one parameter showing a decline, and ten parameters remaining unchanged.

Implementation of JSON Web Token on Authentication with HMAC SHA-256 Algorithm

The rapid growth of information technology is influenced by globalization to accelerate access to information. This creates new problems, as differences must produce relevant information. Of course, system integration will be required. Web Service is a system integration solution that does not consider the platform, architecture, or programming language used in different sources. The security of web service is considered not yet implemented. The JSON Web Token (JWT) technology is an authentication mechanism for web service and will have a significant impact on data security. This implementation optimizes JWT security with the HMAC SHA-256 algorithm. Testing is conducted on two information systems by comparing the performance size when JWT technology is applied to Tim Bebersih Masjid Information System. The results show that the implementation of JWT on Windows Server 2019 (VM) is 462.8 ms with an average data size of 8.59 kb. Testing on the Windows 10 operating system obtained an average speed of 216.25 ms with an average data size of 8.59 kb. The result on Windows Server 2019 (VM) from the JWT performance test itself obtained the highest result, due to the use of virtual machine which is considered to consume a lot of RAM, resulting in performance that is 2 times higher. Keywords: Algorithm, HMAC SHA-256, JSON Web Token, Web Service, Virtual Machine

Secure Location Privacy Transmitting Information on Cellular Networks

As smartphones incorporate location data, there is a growing concern about location privacy as smartphone technologies advance. Using a remote server, the mobile applications are able to capture the current location coordinates at any time and store them. The client awards authorization to an outsider. The outsider can gain admittance to area information on the worker by JSON Web Token (JWT). Protection is giving cover to clients, access control, and secure information stockpiling. Encryption guarantees the security of the location area on the remote server using the Rivest Shamir Adleman (RSA) algorithm. This paper introduced two utilizations of cell phones (tokens, and location). The principal application can give area information by means of the geographic position method of these gadgets. Every cell phone can create a token. The token holds secret keys got from versatile fixed identifiers for the most part of the Social Security Number (SSN) for each SIM (Endorser Personality Module) Chronic Number) and IMEI (Global Portable Hardware Character) by RSA calculation. The token is going through the short and informative administration of Short Message Service (SMS) from the client to the outsider. Information is scrambled before being stored on a faraway worker. The actual worker can't comprehend the area’s information. The third-party cannot follow the area if the client utilizes distinctive mystery keys. The client’s data and area information are saved by the various workers. The proposed application offers a mysterious sharing instrument that uses token verification to grant clients access to scrambled area data and provides encryption data in a remote server with an authentication token, achieving mutual authentication on each mobile device and user concealment.

Model for Storing Tokens in Local Storage (Cookies) Using JSON Web Token (JWT) with HMAC (Hash-based Message Authentication Code) in E-Learning Systems

E-learning is a technology that may be used in the learning process to improve not only the distribution of learning materials but also the ability of learners to modify their abilities of various competencies contained in a database. A Web Service is used to integrate the data. Web Service is a set of standards and programming methods for sharing data between different software applications, distributing services over the internet that supports system interoperability. In this digital era, the system that will survive is one that can function on multiple platforms, and one of the options is to use web servicess. Data is exchanged in JSON format, and JSON Web Tokens are used for authentication security (JWT). The use of JWT for token-based authentication on web services can help overcome interoperability issues. JWT is stateless and allows for the inclusion of data in the token authorisation. JWT includes a number of algorithm possibilities, including HMAC. Overall, the adoption of HMAC outperforms the criteria of token generation time, token size, and token transfer speed. Storing JSON Web Token into local storage in the client browser using the HMAC algorithm has been presented in this paper. The proposed work has shown that JWTs do not need to be stored on the server but can be stored on the client browser side using local storage.

IFaaSBus: A Security- and Privacy-Based Lightweight Framework for Serverless Computing Using IoT and Machine Learning

As data of COVID-19 patients is increasing, the new framework is required to secure the data collected from various Internet of Things (IoT) devices and predict the trend of disease to reduce its spreading. This article proposes security- and privacy-based lightweight framework called iFaaSBus, which uses the concept of IoT, machine learning (ML), and function as a service (FaaS) or serverless computing to diagnose the COVID-19 disease and manages resources automatically to enable dynamic scalability. iFaaSBus offers OAuth-2.0 Authorization protocol-based privacy and JSON Web Token & Transport Layer Socket protocol-based security to secure the patient's health data. iFaaSBus outperforms response time compared to nonserverless computing while responding to up to 1100 concurrent requests. Further, the performance of various ML models is evaluated based on accuracy, precision, recall, F-score, and area under the curve (AUC) values, and the K-nearest neighbor model gives the highest accuracy rate of 97.51%.