Features and security aspects of FASS subsystem

Abstract

This paper describes fundamental goals and features which one open source, free modular Administrator subsystem should provide. Main goal of entire project was to develop stand-alone administrator subsystem, with complete modular access control and strong data encryption of critical data. FASS (Free Administrator Subsystem) is a downgrade version of Administrator subsystem HEFES 2.0, and contains only its basic features. Features and security aspects of Administrator Subsystem HEFES version 1.0 where published in paper [8], while a paper describing full features of Administrator subsystem HEFES 2.0 will be published in the near future. This paper also describes technologies which were used while developing the administrator system. Data encryption is provided by SHA256 algorithm and TSL security standard. FASS subsystem relies on Java Servlet technology which provides full control over response which is sent from server to a client. Since FASS subsystem also relies on MySQL database service, system security is brought to a new level by developing a set of classes which are designed to stop MySQL injection attacks on the system. Formed classes filter every input data and Query parameters which are transmitted while communicating with servlets. Interface of FASS subsystem was developed in a way so it provides simple and functional access to FASS subsystem, which makes job of a System Administrator much easier, especially in the areas of system maintenance and access rights management through developed ROLE system. Implemented ROLE system has a feature of role inheritance by which, access rules can be inherited from some role, and then modified. This concept was borrowed from Oracle type databases. © 2011 IEEE.