Enhancing the Session Security of Zen Cart based on HMAC-SHA256

Zen Cart is an open-source online store management system. It is used all over the world because of its stability and safety. Today, Zen Cart`s session security mechanism is mainly used to verify user agents and check IP addresses. However, the security in verifying the user agent is lower and check...

Full description

Saved in:
Bibliographic Details
Published in:KSII transactions on Internet and information systems 2017-01, Vol.11 (1), p.466-483
Main Authors: Lin, Lihui, Chen, Kaizhi, Zhong, Shangping
Format: Article
Language:Korean
Subjects:
HMAC-SHA256
session security
sessionStorage
Zen Cart
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Zen Cart is an open-source online store management system. It is used all over the world because of its stability and safety. Today, Zen Cart`s session security mechanism is mainly used to verify user agents and check IP addresses. However, the security in verifying the user agent is lower and checking the IP address can affect the user`s experience. This paper, which is based on the idea of session protection as proposed by Ben Adida, takes advantage of the HTML5`s sessionStorage property to store the shared keys that are used in HMAC-SHA256 encryption. Moreover, the request path, current timestamp, and parameter are encrypted by using HMAC-SHA256 in the client. The client then submits the result to the web server as per request. Finally, the web server recalculates the HMAC-SHA256 value to validate the request by comparing it with the submitted value. In this way, the Zen Cart`s open-source system is reinforced. Owing to the security and integrity of the HMAC-SHA256 algorithm, it can effectively protect the session security. Analysis and experimental results show that this mechanism can effectively protect the session security of Zen Cart without affecting the original performance.
ISSN:1976-7277
1976-7277