代做SENG2250 System and Network Security Assignment 3调试Java编程

School of Information and Physical Sciences

SENG2250 System and Network Security

Assignment 3

This assignment is to be done individually.

Due on Friday, 1 November, 11:59pm, electronically via the “Assignment 3” submission link in Canvas.

Total 100 marks

Summary: For this assignment, you will modify a http server program to provide authentication and access control for its various services.

Problem statement: An emerging start-up, Mako, has had some recent success and so have started developing an online portal for their expanding number of employees. Having seen the failings of many other businesses in recent times, the founder of the company has decided that security is of utmost importance for their online portal. This has led them to employ you, an emerging cyber security expert, to  add  authentication  and  access  control  services  to  their   online   portal  in  its  early  phases  of development.

Requirements: You  will   use   either  the  Java   or   Python  skeleton  application1    provided  with  this assessment and add the following features:

• Admin console. This console can only be accessed by clients that are authenticated as a user in the  admin  group.  It  includes  a  collection  of  functions  that  involve  modifying  other  clients, namely add user, modify user, and delete user. Add user allows the admin to add a user to the system. The admin specifies a username and email, and the server generates a random password for that user and sends it to them along with the username in an email. Modify user allows the admin to change the group that a user belongs to. Delete user allows the admin to remove the specified user. (20 Marks)

。 The program should start up with one default user, root, who is a part of the admin group,

and starts with a randomly generated password which is printed by the server program.

• Password storage. The stored passwords of users in the system should follow good practices. (10 Marks)

• Multi-factor authentication.  Before  requesting any service, the client sends the server their username and password, the server then sends a code to the client’s email, which the client must reply with. To handle the sending of the email, we recommend using:

1. You may use a language other than Java or Python, just note that you will likely have to translate the skeleton programs.

https://www.mailgun.com/,https://www.mailjet.com, or directly sending the email from the code. (20 Marks)

• Token authentication. After multi-factor authentication, the client should be given a “token”, which is valid for 15 minutes from being issued. As long as the client provides a correct and valid token to the server, the server will  not  require  multi-factor  authentication. The token  itself should be a unique and hard to guess/predict value (that is a string or number). (20 Marks)

• Access control. There are several services implemented in the server skeleton program, you will add the Biba access control model to them, where object labels of each service are given in Table 1.  All clients are assigned “ rw” permissions for all resources at the access control matrix level, so their access is purely determined according to the rules of the Biba model. Additionally, we provide the read and write endpoints in Table 1, these correspond to the read/write function in the server code for that row’s resource. (16 Marks)

。 This  access  control  model  does  not  apply  to  the  admin  console,  it  instead  can  only  be

accessed (read and write) by users in the admin group.

。 The admin group also has the security level of Top Secret.

。 In total, we have three security levels: Top Secret, Secret, and Unclassified. Their hierarchy is in that same order Top Secret > Secret > Unclassified.

Resource	Security Level	Read Endpoint	Write Endpoint
Finances	Top Secret	audit_expenses	add_expense
Timesheet	Top Secret	audit_timesheets	submit_timesheet
Meetings	Secret	view_meeting_minutes	add_meeting_minutes
Roster	Unclassified	view_roster	roster_shift

Table 1: Object Labels for the Online Portal Resources

•   You will also write a small client program to demonstrate these features, it is sufficient to test and demonstrate each one simply procedurally. (4 Marks)

•    Further details specific to the Java or Python programs are given in the README.md file that is in their respective folders in the starter programs available on Canvas.

Reflections (10 Marks)

As a capstone this assessment, you will write a brief reflection on the program you have helped to develop in the first part of the assignment. This reflection should be about 600-1000 words of length and will firstly discuss what you have learnt from extra resources, such as websites, textbooks, or large language models, to complete the tasks. The reflection will then relate what you have learnt to subjects covered in our labs and lectures. To strengthen your reflection, you will also discuss the limitations of your developed program, such as scalability or the limited environments where it may be securely used, for each of those limitations introduce a technology that would likely address it (e.g. SSL, IPSec, etc.).

Your reflection should cite the extra resources you learnt from, if any, including prompts from LLMs   (such as ChatGPT). Your bibliography should follow a citation standard such as IEEE, APA, or Harvard. The bibliography will not count towards your word count.

Submission Guidelines

Please submit your work in a single zip file. This file should encompass a PDF document illustrating program   execution   with    running   examples   (including screenshots to   validate   the   successful implementation  of  requirements)  and  reflections.  Additionally,  include  a  folder  named  “src”  that contains all of your code and other code adjacent files required to run your programs, it also will contain a “README.md” file which states instructions for setting up and running your programs.

Marking Rubric

Requirement	Basic	Sound	Good	Excellent
Admin Console	(5) Only admin users can access the admin console	(10) The console can be used to add new clients	(15) The console can be used to delete existing clients	(20) The console can be used to modify the group of existing clients
Password Storage	(2) The server stores client passwords	(5) Passwords are stored in a way that the server cannot clearly read them	(8) The server can check that a client provided password matches the stored one	(10) The client provided password is sent to the server in a way that it still be matched to the stored one, but cannot be clearly read either
Multi-factor authentication	(5) The server stops unauthenticated clients from accessing any service	(10) When the server receives a correct username and password, they generate a unique code	(15) The server sends the unique code to that user’s email	(20) The client can use that code to access the server (or gain a token if you have working token authentication)
Token Authentication	(5) The server provides the client a token	(10) The token is a unique and hard to guess value	(15) The token can be used for authentication	(20) The token remains valid for only 15 minutes
Access Control	(4) Access control mechanisms are only applied to one of the resources	(8) Access control mechanisms function correctly for two resources	(12) Access control mechanisms function correctly for three resources	(16) Access control mechanisms function correctly for all four resources
Client program	(1) The client program tests all the endpoints as single user	(2) The client program tests all endpoints as each type of user (differing groups/labels)	(3) The client program uses a token (or imitation, if there is no token authentication) where possible	(4) The client program tests each possible unique response that the server can give (token, no token, different labels, groups, etc.)
Reflections	(2) Only includes a list of what was learnt from external resources	(5) Includes a discussion of what was learnt from external resources	(8) Along with the discussion, includes a reflection of how the task relates to our lecture and lab content	(10) Along with the discussion and lab + lecture reflection, discusses the limitations of the developed program, and potential ways of addressing them

**Note: Marks may fall in between these cases for submissions of intermediate qualities, or if a lower- level feature is missing despite there being a higher level one.