Data security mechanisms

Unified system of authentication and authorization

The unified authentication and authorization system is a key component of data protection that provides secure access to system resources. It lets you manage users, their permissions, and access to data at the system-wide level.

Reminder:

• Authentication is the process of verifying the identity of a user (for example, with a username and password).
• Authorization is the process of verifying a user’s permissions to perform certain actions (for example, access to data or system functions).

System components

Authentication

• Login and password: the traditional method of authentication. When logging in, the user must first identify themselves with a username and password.
• Multi-factor authentication (MFA): the use of several factors (for example, a dynamically updated software token for the web API).

Token-based authentication simplifies the process for established users. To get started, the user sends a request to the server with a username and password. The server validates them against the values registered in its identity database. If the identity is confirmed, the server returns an authentication token (which is also stored in the database).

When the same user later requests access to protected resources, those requests can be authorized with the authentication token instead of a username and password. The server checks the token against the one registered in the database and grants access.

Authorization

• Roles and permissions: users are assigned roles (for example, access administrator, user) that define their permissions.
• ACL (Access Control Lists): lists that define who has access to which resources.
• RBAC (Role-Based Access Control): role-based access control.
• ABAC (Attribute-Based Access Control): attribute-based access control (for example, by time of day or location).

User data storage

• User database: stores information about users, their roles, and permissions in a single database.

Security

• Encryption: protects data during transmission and storage.
• Access tokens: dynamically updated software tokens used for session management.
• Auditing: logging of all user actions for later analysis.

System implementation

The platform uses a token-based authentication flow. The user signs in with a login and password, the system validates them and returns an access token, and that token is then sent with every subsequent request to authorize access to protected resources. The user’s email address is used as the login.

Example of a request in Curl format:

curl -i --header "Content-Type: application/json" \
--request POST \
--data '{"email":"api@local.net","password":"Str0ngPas$"}'\
https://server123/api/v1/auth/sign_in

In response, we receive the following message:

HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Download-Options: noopen X-Permitted-Cross-Domain-Policies: none Referrer-Policy: strict-origin-when-cross-origin Content-Type: application/json; charset=utf-8 access-token: tgervk9_9xicJYpmSsnnNA
token-type: Bearer
client: D-Uv3ER53873olhnNLjL9w
expiry: 1615227012
uid: api@local.net
ETag: W/"5b9bcc76f7223b72b79d9f2d31ff0fd5"
Cache-Control: max-age=0, private, must-revalidate
X-Request-Id: c18e06b4-e5bd-40b5-875d-7ac958e2fbb5
X-Runtime: 0.391069
Transfer-Encoding: chunked
{"data":{"id":6,"email":"api@local.
net","provider":"email","uid":"api@local.net","name":"API user"}}

In this response, we are interested in the access_token parameter. The value of this header is used as the password for each request and changes with every request.

Here is an example of a request that uses the token from the previous response:

curl -i --header "access-token: tgervk9_9xicJYpmSsnnNA" \
--header "token-type: Bearer" \
--header "client: D-Uv3ER53873olhnNLjL9w" \
--header "uid: api@local.net" \
--request GET \
--header "Content-Type: application/json" \
--data '{"page":"2"}' \
https://server123/api/v1/stations

In response, we receive the following message:

HTTP/1.1 200 OK
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
Referrer-Policy: strict-origin-when-cross-origin
Content-Type: application/json; charset=utf-8
access-token: Bmh2GVrxr6aW0Hngor4gPw
token-type: Bearer
client: D-Uv3ER53873olhnNLjL9w
expiry: 1615311367
uid: api@local.net
ETag: W/"ba0df406b647bd92f0bf3a18916714c1"
Cache-Control: max-age=0, private, must-revalidate
X-Request-Id: 35a26441-ae78-48fa-8b2e-e92d2605133b
X-Runtime: 0.167748
Transfer-Encoding: chunked
{"data": [
{"id":1,"name":"865293041101853","equipment_brand_name":"Corrector
BK","phone":"","equipment_id":1},...
],
"total_pages":7,
"current_page":2
}

To end the session, you can use the SignOut procedure, or save the necessary headers from the last request and reuse them next time if the token has not expired. Note that without ending the session, the last token remains valid for some time, depending on the server’s system settings.

Advantages of the system

A unified authentication and authorization system is a powerful tool for data protection and access control. It provides the following benefits:

• Centralized management: simplifies managing users and their permissions.
• Security: protects data from unauthorized access.
• Consistency: all applications and systems use the same authentication and authorization mechanism.
• Scalability: makes it easy to add new applications and users.

Data encryption

To protect critical information, the system uses encryption (converting information into a form that cannot be read without the appropriate key) and hashing (converting data into a unique fixed-length string — a hash). This is one of the key data protection mechanisms, ensuring the confidentiality, integrity, and security of information both in storage and in transit.

The system uses various data encryption and hashing algorithms.

Application of encryption in the system

Storage encryption

• Databases: encrypting individual database fields.
• Files: encrypting files before saving them to disk.

Encrypting data in transit

• HTTPS: using SSL/TLS to encrypt data during network transmission.
• VPN: creating a secure tunnel for data transmission.

Password encryption

Storing password hashes instead of passwords.

Examples of data encryption and decryption

Let’s look at examples of encrypting and decrypting system configuration files.

Data encryption

mkdir_p(encrypted_dir_path)
encrypted = Rails.application.encrypted(encrypted_file_path, key_path: 'config/system.key')
encrypted.write(File.read(decrypted_file_path))
File.delete(decrypted_file_path)

Data decryption

mkdir_p(decrypted_dir_path)
File.write(decrypted_file_path,
  Rails.application.encrypted(encrypted_file_path, key_path: 'config/system.key').read
)

Benefits of data encryption

• Confidentiality: protecting data from unauthorized access.
• Integrity: ensuring that data has not been altered.
• Authenticity: confirming the source of the data.
• Compliance requirements: meeting regulatory requirements.

Audit and monitoring

Several subsystems monitor user and system activity, detect suspicious behavior, and ensure compliance with security requirements. Together they:

• collect, analyze, and store information about user and system activity to ensure accountability and compliance;
• continuously monitor the system and equipment in real time to detect and respond to incidents.

Objectives

• Accountability: ensuring that all user and system activity is recorded.
• Security: detecting and preventing unauthorized activity.
• Problem detection: identifying hardware problems and anomalies and taking corrective action.
• Performance optimization: analyzing system performance and finding bottlenecks that require optimization.
• Prediction and planning: collecting data to forecast future workloads and plan resources.
• Compliance: ensuring compliance with regulatory requirements.
• Incident analysis: analyzing incidents that have occurred to prevent future ones.

Audit and monitoring components

Data collection

• Logs: records of user and system actions at all levels.
• Metrics: system performance data (for example, CPU utilization, memory usage).

Data storage

• Log storage: collecting data from various sources, with distributed storage of logs and metrics organized by topic area.
• Log rotation: automatic deletion of old logs to save space.

Data analysis

• Search and filter: the ability to search and filter logs by various criteria.
• Analytics: the use of data analysis tools (for example, Zabbix).

Alerts

• Alerts: sending notifications about suspicious activity and emergencies (for example, by email or Telegram chat).
• Automatic actions: automatically responding to incidents (for example, blocking a user).

Example implementation

Logging

Using a library for logging in the application.

# Logs all changes to models
gem "audited"

# Logging settings
Audited.config do |config|
    config.audit_class = CustomAudit
end

class CustomAudit < Audited::Audit
  default_scope { order(created_at: :desc) }

  ACTION_NAME = { 'Create' => 'create',
                  'Update' => 'update',
                  'Destroy' => 'destroy' }.freeze

end

# Metering device
class Equipment < ApplicationRecord
  audited except: [:password]
	...
end

Collection of errors in data from meters

# data model for error collection
class ErrorLog < ApplicationRecord
    enum message: { invalid_equipment_serial_number: 0,
                  invalid_equipment_software_version: 1,
                  ...
                  }
    belongs_to :loggable, polymorphic: true
    belongs_to :loggable_equipment, class_name: 'Equipment', foreign_key: :loggable_id, optional: true
    validates :loggable_type, :loggable_id, :message, presence: true
end


# Event log
unless valid_value?(serial_number)
	message_params = {equipment: equipment, new_serial_number: serial_number}
	message2logger(loggable_obj: equipment, message: :invalid_equipment_serial_number, params: message_params)
end

Log storage

Using centralized storage for logs.

Table audits

This table stores data-logging information.

Table error_logs

This table stores information about errors in the data coming from the meters.

Log analysis

Tools used to analyze logs:

• Setting up web forms to visualize and analyze logs.
• Creating dashboards to monitor user activity.

Alerts

Customized alerts for suspicious activity:

• Configuring alerts in Zabbix to monitor metrics.
• Sending notifications by email or Telegram chat for alarm events.

Benefits of auditing and monitoring

Auditing and monitoring are powerful data protection tools that let you track user and system activity, identify suspicious behavior, and ensure compliance with security requirements. They allow you to:

• ensure data accountability and security;
• identify and prevent incidents;
• meet regulatory requirements.