Hello, if you have any need, please feel free to consult us, this is my wechat: wx91due

School of Information and Physical Sciences

SENG2250 System and Network Security

Assignment 3

This assignment is to be done individually.

Due on Friday, 1 November, 11:59pm, electronically via the “Assignment 3” submission link in Canvas.

Total 100 marks

• Admin console. This console can only be accessed by clients that are authenticated as a user in the admin group. It includes a collection of functions that involve modifying other clients, namely add user, modify user, and delete user. Add user allows the admin to add a user to the system. The admin specifies a username and email, and the server generates a random password for that user and sends it to them along with the username in an email. Modify user allows the admin to change the group that a user belongs to. Delete user allows the admin to remove the specified user. (20 Marks)
• The program should start up with one default user, root, who is a part of the admin group, and starts with a randomly generated password which is printed by the server program.
• Password storage. The stored passwords of users in the system should follow good practices.
• (10 Marks)
• Multi-factor authentication. Before requesting any service, the client sends the server their username and password, the server then sends a code to the client’s email, which the client must reply with. To handle the sending of the email, we recommend using:https://www.mailgun.com/, https://www.mailjet.com, or directly sending the email from the code.
• (20 Marks)
• Token authentication. After multi-factor authentication, the client should be given a “token”, which is valid for 15 minutes from being issued. As long as the client provides a correct and valid token to the server, the server will not require multi-factor authentication. The token itself should be a unique and hard to guess/predict value (that is a string or number). (20 Marks)
• Access control. There are several services implemented in the server skeleton program, you will add the Biba access control model to them, where object labels of each service are given in Table 1. All clients are assigned “rw” permissions for all resources at the access control matrix level, so their access is purely determined according to the rules of the Biba model. Additionally, we provide the read and write endpoints in Table 1, these correspond to the read/write function in the server code for that row’s resource. (16 Marks)
• This access control model does not apply to the admin console, it instead can only be accessed (read and write) by users in the admin group.
• The admin group also has the security level of Top Secret.
• In total, we have three security levels: Top Secret, Secret, and Unclassified. Their hierarchy is in that same order Top Secret > Secret > Unclassified.

Table 1: Object Labels for the Online Portal Resources

• You will also write a small client program to demonstrate these features, it is sufficient to test and demonstrate each one simply procedurally. (4 Marks)

• Further details specific to the Java or Python programs are given in the README.md file that is in their respective folders in the starter programs available on Canvas.

As a capstone this assessment, you will write a brief reflection on the program you have helped to develop in the first part of the assignment. This reflection should be about 600-1000 words of length

and will firstly discuss what you have learnt from extra resources, such as websites, textbooks, or large language models, to complete the tasks. The reflection will then relate what you have learnt to subjects covered in our labs and lectures. To strengthen your reflection, you will also discuss the limitations of your developed program, such as scalability or the limited environments where it may be securely used, for each of those limitations introduce a technology that would likely address it (e.g. SSL, IPSec, etc.).

Please submit your work in a single zip file. This file should encompass a PDF document illustrating program execution with running examples (including screenshots to validate the successful implementation of requirements) and reflections. Additionally, include a folder named “src” that contains all of your code and other code adjacent files required to run your programs, it also will contain a “README.md” file which states instructions for setting up and running your programs.

**Note: Marks may fall in between these cases for submissions of intermediate qualities, or if a lower-level feature is missing despite there being a higher level one.