Enhancing the Session Security of Zen Cart based on HMAC-SHA256 = Enhancing the Session Security of Zen Cart based on HMAC-SHA256

다국어 초록 (Multilingual Abstract)

Zen Cart is an open-source online store management system. It is used all over the world because of its stability and safety. Today, Zen Cart`s session security mechanism is mainly used to verify user agents and check IP addresses. However, the security in verifying the user agent is lower and checking the IP address can affect the user`s experience. This paper, which is based on the idea of session protection as proposed by Ben Adida, takes advantage of the HTML5`s sessionStorage property to store the shared keys that are used in HMAC-SHA256 encryption. Moreover, the request path, current timestamp, and parameter are encrypted by using HMAC-SHA256 in the client. The client then submits the result to the web server as per request. Finally, the web server recalculates the HMAC-SHA256 value to validate the request by comparing it with the submitted value. In this way, the Zen Cart`s open-source system is reinforced. Owing to the security and integrity of the HMAC-SHA256 algorithm, it can effectively protect the session security. Analysis and experimental results show that this mechanism can effectively protect the session security of Zen Cart without affecting the original performance.

참고문헌 (Reference)

1 CVE Details, "Zen-cart : Vulnerability Statistics"

2 Wikipedia, "Zen Cart"

3 Ende93, AlexChao, "Window.sessionStorage"

4 Berners-Lee T, "Uniform Resource Identifiers(URI) : Generic Syntax" 4 (4): 84-87, 2005

5 Saini, Vineet, "Threat modeling using attack trees" 23 (23): 124-131, 2008

6 Unger, T., "Shpf: Enhancing http(s) session security with browser fingerprinting" 255-261, 2013

7 Adida, Ben, "Sessionlock : securing web sessions against eavesdropping" 517-524, 2008

8 Wei Guo, "Security analysis and construction of chaotic Hash function" Southwest Jiaotong University 2011

9 De Ryck, P., "SecSess : keeping your session tucked away in your browser" 2171-2176, 2015

10 Gebotys, C. H., "Preaveraging and carry propagate approaches to side-channel analysis of HMAC-SHA256" 15 (15): 1-19, 2016

11 D. Wichers, "Owasp top 10" OWASP Foundation 2013

12 Dietz, M., "Origin-bound certificates: a fresh approach to strong client authentication for the web" 317-331, 2012

13 Dacosta, I., "One-time cookies: preventing session hijacking attacks with stateless authentication tokens" 12 (12): 336-345, 2012

14 Hallam-Baker, Phillip, "Http integrity header"

15 Krawczyk, Hugo, "Hmac: Keyed-hashing for message authentication"

16 Franks, J., "HTTP authentication: Basic and digest access authentication" 1999

17 Kuo-Jui Wei, "Enhancing the Security of Credit Card Transaction based on Visual DSC" 한국인터넷정보학회 9 (9): 1231-1245, 2015

18 Juels, A., "Cache cookies for browser authentication" 301-305, 2006

19 Johns, M., "BetterAuth : web authentication revisited" 169-178, 2012

20 Adida, Ben, "Beamauth : two-factor web authentication with a bookmark" 48-57, 2007

21 HE Run-min, "Analysis safety of SHA-256 algorithm" 22 (22): 31-33, 2014

22 Ismail, Reem Jafar, "A Secure Session Management Based on Threat Modeling" 54 (54): 1176-1182, 2013