Session Timeout Research Articles

Enhancing Network Security in Mobile Applications with Role-Based Access Control

In today's dynamic networking environment, securing access to resources has become increasingly challenging due to the growth and progress of connected devices. This study explores the integration of Role-Based Access Control (RBAC) and OAuth 2.0 protocols to enhance network access management and security enforcement in an Android mobile application. The study adopts a waterfall methodology to implement access control mechanisms that govern authentication and authorization. OAuth 2.0, a widely adopted open-standard authorization framework, was implemented to secure user authentication by allowing third-party access without exposing user credentials. Meanwhile, RBAC was leveraged to streamline access permissions based on predefined user roles, ensuring that access privileges are granted according to hierarchical role structures. The main outcomes of this study show significance towards the improvements in security enforcement and user access management. Specifically, the implementation of multi-factor authentication, session timeout mechanisms, and user role-based authorization ensured robust protection of sensitive data while maintaining system usability. RBAC proved effective in controlling access to various system resources, such as database operations which was presented in scenario of physical access to doors, while OAuth 2.0 provided a secure communication channel for authentication events. These protocols, working in tandem, addressed key issues like unauthorized access, data integrity, and scalability in network security policy enforcement. This research deduces that combining RBAC and OAuth 2.0 protocols in mobile applications enhances security posture, simplifies access management, and mitigates evolving threats.

Analysis of Web Vulnerability Using Open-Source Scanners on Different Types of Small Entrepreneur Web Applications in Malaysia

Most of Malaysia’s small entrepreneurs have switched to online platforms as an alternative to their physical businesses. Social media sites such as TikTok, Instagram, Twitter, and Facebook provide free advertising tools and convenient access to a broader global target. However, security issues on these websites remain questionable as users are exposed to web attacks due to the vulnerabilities on the websites. Considering the cost and lack of awareness of the importance of cybersecurity, some organizations find it not profitable to invest in securing their websites. Therefore, this paper aims to test Malaysian small entrepreneurs’ web applications using open-source scanners and analyse the results of web vulnerabilities detected. To do so, two types of open-source scanners, OWASP ZAP and IRONWASP, were installed to scan five websites found through advertisements on social media sites. The web vulnerability identification was based on the top 5 OWASP web vulnerability reports, and the results showed that five types of web vulnerabilities were detected. The analysis of the results showed that the top 5 web vulnerabilities in Malaysian small entrepreneurs’ websites are the ‘Missing Session Timeout’ vulnerability with 81.84 percent, the ‘Sensitive Information Passed as Clear Text in GET URL’ vulnerability with 14.74 percent, and the ‘Session ID Cookies not Marked Secure’ vulnerability with 2.47 percent. This paper provides security analysis on Small Medium Enterprise (SME) websites for future enhancement and consideration during development and implementation to avoid possible attacks. Therefore, developers are advised to handle these vulnerabilities by carefully managing the session timeout, and users are recommended to log out from the websites immediately after they are done.

Session-Based Time-Window Identification in Virtual Learning Environments

Students organize and manage their own learning time, choosing when, what, and how to study due to the flexibility of online learning. Each person has unique learning habits that define their behaviours and distinguish them from others. To investigate the temporal behaviour of students in online learning environments, we seek to identify suitable time-windows that could be used to investigate their temporal behaviour. First, we present a novel perspective for identifying different types of sessions based on individual needs. The majority of previous works address this issue by establishing an arbitrary session timeout threshold. In this paper, we propose an algorithm for determining the optimal threshold for a given session. Second, we use data-driven methods to support investigators in determining time-windows based on the identified sessions. To this end, we developed a visual tool that assists data scientists and researchers to determine the optimal settings for session identification and locating suitable time-windows.

Accessibility first: detecting frustration in web browsing for visually impaired and sighted smartphone users

AbstractSmartphone adoption has become increasingly prevalent in modern society, reflecting the widespread integration of these devices into various aspects of daily life, yet accessibility and usability problems persist. Smartphones pose numerous challenges to individuals with visual impairments (VI). This is due to smaller screen sizes, lack of physical buttons, and prevalent problems. These challenges frustrate users as they are unable to accomplish their goals. In this paper, the physiological response of VI and sighted individuals are compared and examined. The participant's frustration is measured through physiological signals. The GSR is the signal captured to detect the user's frustration caused by the superimposed accessibility and usability web-related issues. GSR, being less obtrusive, is an effective way to measure frustration. There were 13 VI and 16 sighted participants. Using a within-subject and between-subject design, participants completed four tasks, each was completed under frustrating and non-frustrating conditions while wearing an Empatica E4 wristband to collect GSR data. Challenges were both group-specific and mutual. A slowed internet connection and constant page refreshes are frustrating tasks for sighted participants. VI participants faced an unsearchable drop-down list and an inaccessible menu. Pop-up ads and session timeout are common tasks. Among VI participants, there was no significant difference between frustrating and non-frustrating tasks. When VI participants experienced a session timeout, they significantly showed a higher level of arousal. When comparing the physiological responses of sighted and VI participants in the page refresh and session timeout tasks, the results show that the arousal level is significantly higher in VI participants, primarily due to accessibility issues.

DEVELOPMENT OF AN IVR PAYMENT SYSTEM

The payment system in Nigeria has experienced a major shift in recent years from the traditional mode of payment, resulting in a cashless society through mobile banking. This is a welcome development as the traditional system has a lot of drawbacks like spending hours on a queue just to make a transaction. Also, the advent of debit cards poses a challenge of inability to make payments if the card is not readily available, coupled with outrageous service charges from POS operators. Even in mobile banking, some challenges still abound such as network failure and session timeout which can be experienced while using USSD or Mobile banking applications. We are proposing an IVR payment system for customers to make payments to merchants for their goods and services. This system is very unique as it is yet to be explored in this part of the world. Imagine being able to make payments through a phone call. The need for better payment alternatives which hinges on convenience, affordability, accessibility and speed cannot be overemphasized. Our system does not require mobile data to be able to make payment transactions after purchase. Interestingly, it does not necessarily require a smartphone and as such has a high penetration especially in the rural areas, also providing a vocal guide to initiate payments for those who are visually impaired. We are able to achieve this by implementing the IVR technology, enabling customers and merchants to enroll on the platform and carry out payment transactions.

Penerapan Keamanan Owasp Terhadap Aplikasi GTFW Pada Website Universitas Battuta

In this study, we will test the penetration of GTFW-based applications that have been carried out, then obtain the results as a session management category vulnerability test, namely 3 that did not pass, namely cookie attributes, CSRF, and session timeout, then the vulnerability of the input validation category there was 1 that did not pass, namely stored XSS. The xplorin application has a cookie attribute vulnerability with a Medium vulnerability risk level. The xplorin application has a CSRF vulnerability with a Medium vulnerability risk level. The xplorin application has a session timeout vulnerability with a Low vulnerability risk level. The xplorin application has a stored XSS vulnerability with a Low risk level of vulnerability.

Session layer security enhancement with md5 and multiplicative inverse cryptographic mechanism

This paper proposes MD5 and Multiplicative Inverse based Data Encryption Model for security of data during data transmission. It discusses about Cloud computing mechanism which is used to deliver information technology services. In cloud computing, Data security is biggest issue and significant aspect of Internet for enterprises of each size and type. However there are several existing researches that proposed different security mechanisms but they have certain limitations. Therefore this proposed model is developed to enhance the security of data at multiple layers. User defined port and IP address is used to make this proposed model more secure data transmission model. Moreover, the early session timeout is also controlled by reducing packet size. Proposed work would be capable to increase the efficiency of data communication along with security. In addition, unauthentic access of data is restricted using IP validation process.

Multilevel Authentication for Social Network

Nowadays, social network plays a vital role in communication. Normally user used social networks in daily activities. However, this left all online users susceptible to misuse and abuse. Recently, there has been a remarkable growth in number of hacking as well. Once the computer is online, anyone can have access to the network. Therefore, we proposed a secure social network site called SocialBook where users can post status, photos and connect with friends. This system is developed using PHP programming language and Iterative and Incremental Development methodology. The purpose of developing this system is to solve unsecured login accounts and lack of user authentication problem. This system applies the secret question procedure when the user wants to change their account password. Moreover, SocialBook use idle session timeout mechanism for additional security. When the user is idle for ten minutes, they will be logged out automatically. So, the user will be less worry about their account from being hacked and the identity impersonation by unauthorized user.

Multilevel Authentication for Social Network

Nowadays, social network plays a vital role in communication. Normally user used social networks in daily activities. However, this left all online users susceptible to misuse and abuse. Recently, there has been a remarkable growth in number of hacking as well. Once the computer is online, anyone can have access to the network. Therefore, we proposed a secure social network site called SocialBook where users can post status, photos and connect with friends. This system is developed using PHP programming language and Iterative and Incremental Development methodology. The purpose of developing this system is to solve unsecured login accounts and lack of user authentication problem. This system applies the secret question procedure when the user wants to change their account password. Moreover, SocialBook use idle session timeout mechanism for additional security. When the user is idle for ten minutes, they will be logged out automatically. So, the user will be less worry about their account from being hacked and the identity impersonation by unauthorized user.

Continuous and Transparent User Identity Verification for Secure Internet Services

Session management in distributed Internet services is traditionally based on username and password, explicit logouts and mechanisms of user session expiration using classic timeouts. Emerging biometric solutions allow substituting username and password with biometric data during session establishment, but in such an approach still a single verification is deemed sufficient, and the identity of a user is considered immutable during the entire session. Additionally, the length of the session timeout may impact on the usability of the service and consequent client satisfaction. This paper explores promising alternatives offered by applying biometrics in the management of sessions. A secure protocol is defined for perpetual authentication through continuous user verification. The protocol determines adaptive timeouts based on the quality, frequency and type of biometric data transparently acquired from the user. The functional behavior of the protocol is illustrated through Matlab simulations, while model-based quantitative analysis is carried out to assess the ability of the protocol to contrast security attacks exercised by different kinds of attackers. Finally, the current prototype for PCs and Android smartphones is discussed.

Empirical observations on the session timeout threshold

The World Wide Web is a popular “tool” for companies. It can be used as a method of communication between companies and their customers; it also allows organizations to setup virtual storefronts that can be accessed by customers from all over the world. The ability to understand customers’ behavior is extremely important as companies strive to increase the usability and profitability of their web service. The concept of a session is a popular unit of measurement used to analyze recorded information. However, this concept is currently rather abstract and lacks definition. How we measure a session is a fundamental question for web services utilizing this concept. Currently, this question has no real answer. This paper presents a session timeout threshold model based on empirical observations as an initial answer to this question. The model seeks to provide accurate session data with respect to individual web services.