Tag: Cybersecurity

In the world of technology, tracking is not a strenuous task, which will require meticulous efforts. Geo-fencing is one of the technology blessings we are working with. But what is this geo-fencing, how has it developed, in what ways it works, how is it useful and where is it used? Let’s discuss all these answers one by one via this article.

GEO-FENCING

In the word Geo-fencing, the Prefix “Geo” is a Greek word meaning “earth or land” and “fencing” means “drawing an imaginary border” Thus, Geo-fencing defines as setting up fencing or a virtual perimeter boundary to know whenever an object enters within the marked fencing zone.

As the definition explained above, defines Geo-fencing technology as a location-based service (LBS). In this, the app or any other medium by which the service is in use depends on GPS (Global Positioning System), Wi-Fi or cellular data and RFID(Radio-Frequency Identification) to activate the organized action which is based on whenever a device enters or exits the set virtual boundary locations or Geo-fence. The alert can be sent in many ways set up by the developer, it can be in a trigger form of text, pop-up, push notifications, track alert messages etcetera. 

How the Geofencing Work?

The developer set up the virtual boundary using GPS or RFID services or even an IP address in some cases to set up the fencing zone and then set up a per-planned alert system for the device which is going to enter or exit from the fencing zone. As soon as you enter the fence, will be tracked by the developer in case of tracking; you will get a push notification, if the fencing is set up for some marketing or business deals, you will get a message if the fencing is set up for any other purposes related to work personal or professional. So, therefore we can say that Geo-fencing has made life easy for everyone except those who are in the adversary zone. The fence in the Geo-fencing can vary in the perimeter zone, i.e., they can be changed,  reduced or increased depending upon the user and developer. 

Example: If you are running a salon and you want the customers in closer proximity to your location to know about the venue, you can set up the fencing perimeter and send the alerts in whatever format you want to give. 

Geo-fencing Application

In this era of digitization, Geo-fencing has become a crucial way for every sector whether it is a public or private one; whether it is in the security zone or marketing world; whether it is in IT or business firms. Once geographic fencing is set, the opportunities and usage are seemingly endless and that’s one of the reasons that it has become especially popular in marketing and social media lines.

Some of the common Geo-fencing Applications are as follows:

Security: Geo-fencing can be used to make your devices more secure. Like you can set your own Geo-fencing for your device for a specific area like your home, to get push-up notifications whenever someone enters your home.

Social networking: With Geo-fencing development comes its usage in one of the most popular platforms of the last decade called social media. Geo-fencing is the social media app network that gives the application of location status, location sending, and location-based stories to other devices and all these are all made possible with Geo-fencing. 

Human resources: For fencing the on-field employees, and workers and to track the employees, companies nowadays use Geo-fencing to keep a record of employees. Geo-fencing is also useful as a way to automate time cards, employee clocking means keeping track of when they go in and out, within the premises.

Marketing: Geo-fencing is a popular way for business firms to promote themselves by an alert pop-up whenever you are within the fencing range of the company. One of the best use of Geo-fencing is that it helps businesses in targeted ads to a specific audience instead of mass-adherence to figure out the right set of strategies with the right set of people based on the user’s location data.

Telematics: Telematics, the process of merging telecommunications and informatics via any device- Geo-fencing plays a very useful role here as well by allowing companies to set virtual zones around sites, work premises and secure zones. 

Smart appliances: Smart appliances have made us enter the smart world and Geo-fencing is one of the smartest use of these smart appliances  With the capability of smart work of appliances, it’s easier than ever before like reminding you of some household chores, reminding you some office-related files, kids assignments and all. 

The use of Geo-fencing in handling Pandemic COVID19:

When the entire nation is struggling for survival from the pandemic coronavirus, people in technology are working to tackle this problem via the use of technology. Developers from different zones of the country have developed a geo-fencing-based app for COVID-19 to track the people who are on the fence about getting affected by the Coronavirus.

Ministry of Electronics and information technology (MEITY)-GOI has developed an app called ‘AAROGYA SETU’ for citizens to know the risk of contracting COVID-19 by Geo-fencing tracking service. The tracking is done via Bluetooth & location-generated social graphs, which can show your interaction with anyone who has tested positive-All you have to do after the installation is to switch on the Bluetooth and location. By switching on the following you will be in the line of sight of developers and once you crossed paths with the red zone area you will get an alert message based on the information. Thus, Geo-fencing is playing a crucial role in handling this pandemic.

Geo-fencing Future

In this world of data-privacy where everyone is concerned about their data getting stolen, Geo-fencing faces the same criticism of possibilities of a data breach but as said by Nasscom chief R. Chandrasekhar, ‘There is nothing called fully perfect security in IT’, thus we can’t play the data-breach game with Geo-fencing anymore. According to a press release from Markets and Markets (https://www.marketsandmarkets.com/), the Geo-fencing industry is expected to grow by over 27% by 2022, citing “technological advancements in the use of spatial data and increasing applications in numerous industry verticals.”

References:

https://en.wiktionary.org/wiki/Wiktionary

https://meity.gov.in

https://en.wikipedia.org/wiki/Geo-fence

HTTP (HTTP://)– Hyper Text Transfer Protocol is a Protocol designed for communication between client (Web browser) and server(Web server). It was projected in 1989 by the world wide web. It operates on Port 80 and transfers data in plain text. There were a few revisions in HTTP until http1.1 released in 1996.Then after finding so many loopholes, There was a mega release of HTTP/2 in 2015. Later, HTTP/3 as the proposed successor to HTTP/2 came out, which is already in use on the web, using UDP instead of TCP for the underlying transport protocol. 

Advantages of HTTP:-

1. HTTP can be implemented with other networks as well as protocols.
2. HTTP pages are stored on computers as internet caches.
3. The platform of HTTP is independent, thus allowing cross-platform porting.
4. It can be used over Firewalls.

Issues with HTTP:-

1. HTTP is a stateless protocol, which means it does not require the HTTP server to retain information or status about each user for the duration of multiple requests. Each time the requests will be treated unique or new irrespective whether it is new or old.
2. No privacy, as open for all, and anyone can see the content.
3. Data Integrity is 0, here as security and privacy are absent here and anyone can alter the content.
4. Anybody irrespective of a genuine user or not, can intercept the request and can get the username and password.

HTTPS (HTTPS://)– Hyper Text Transfer Protocol Secure, an advanced as well as the secured version of HTTP. It allows secured transference with the help of SSL (Secure Sockets Layer). HTTPS is a combination of SSL/TLS with HTTP. It provides encrypted data and secured transference with the help of key-based encryption algorithms, in which key is generally 40 or 128 bits in strength. It operates on port 443 and transfers data in Cipher (encrypted) format.

Advantages of HTTPS:-

1. Sites running over HTTPS are redirected, which means even if you type in HTTP:// by mistake, it will redirect to an HTTPS over a secured connection.
2. Secured with SSL/TLS and provide full encryption over data.
3. Each SSL Certificate contains unique, authenticated information about the certificate owner.

Issues with HTTPS:-

1. HTTPS protocol can’t stop stealing confidential information from the pages if they are saved as cache memories on the browser.
2. SSL data can be encrypted only during transmission via a network, thus the text in the browser memory is still not cleared with SSL.

Difference between HTTP and HTTPS :-

                 HTTP

               HTTPS

-Hyper Text Transfer Protocol

-Hyper Text Transfer Protocol Secure

-Less secure and encryption is absent.

-Secure and encrypted with SSL/TLS.

-Uses Port 80.

-Uses Port 443.

-Doesn’t scramble data before transmission, thus vulnerable to hackers.

-Scramble Data before transmission, thus secure.

-It operates on TCP/IP level protocol.

-It operates on the same HTTP protocol but with SSL/TLS.

-No SSL and data encryption.

-SSL and data encryption are required.

-Fast in procession.

-Slow in processing in comparison to HTTP.

-It operates on an Application layer.

-It operates on the Transport layer.

-It transports plain text information.

-It transports cipher text information.

Whenever we browse the internet, we see some site URLs, there is a padlock present and in some, it is absent. The presence of this padlock symbolizes secure communication between the user and the server. This padlock consists of a secure communication certificate and that certificate communication is called SSL Certificate communication i.e., Secure Socket Layer. SSL’s function is to build a secure chain of trust between the user and the server. The certificate is provided by a Certificate Authority (CAs) like Let’s Encrypt, Bypass, Comodo, GeoTrust et cetera, which actually builds the chain of trust running the certificate validation in a hierarchical manner.

Most modern web browsers have flagged sites without SSL/TLS as insecure or unsafe. Going forward, SSL/TLS certificate may become a mandatory website hosting requirement. By hosting a website with SSL/TLS certificate, it provides security to the data transferred between the website and the Website visitor, by encrypting the communication, in addition to this the SSL/TLS certificate also helps to verify the identity of the site, thereby helping users to surf on a secure and encrypted connection. The SSL certificate consists of Website Owner information including Domain and sub-domain name, the Validity period of the certificate, Public key used for encryption

TLS is the new or updated version of SSL; TLS has evolved from SSL (Secure Socket Layer) only, which was developed by Netscape Communication in 1994. SSL 1.0 was never used but followed by SSL and 3.0. TLS 1.0 is based on SSL 3.0. TLS 1.3 is the latest version, published in the year 2018  and almost all Cas are using or moving to TLS1.3. The presence of secure connection or TLS can be seen through HTTPS presence in URL, which is an implementation of TLS encryption on top of HTTP protocol, which is used by all the websites running web services. Hence, any website over https is deploying TLS only.

                       USER——–(SSL/TLS HANDSHAKE)——–CLIENT

SSL CERTIFICATE VALIDATION AT DIFFERENT LEVELS:

1)    DOMAIN VALIDATED CERTIFICATE: In this validation, only a domain name is validated and a certificate is issued in this validation name only. That’s why it is the easiest validation in the SSL certificate validation game. It is beneficial for servers who are just willing to take SSL for namesake or blogs, and small enterprises not dealing with products or selling.

2)    ORGANISATION VALIDATED CERTIFICATE: In this validation, additional details like the address of that particular server with the domain name will be required for the validation check to pass. Thus, it is a bit more stringent than domain one. The additional details validation makes it more trustworthy on the user’s end.

3)     EXTENDED VALIDATION CERTIFICATE: This is the most cost-equipping, trustworthy, time taking validation. This is required by all the large e-commerce, enterprises and business to mark up with the customer trust level.

TYPES OF SSL CERTIFICATES:

1)    Single Domain SSL: As the name defines, it is a single domain name, thus, only and only single name domain SSL will be generated, and no other name or sub-domain name will be able to use the certificate.

2)    Wildcard SSL certificate: The domain and all sub-domain along with this will be able to use the certificate known as Wildcard SSL. The sub-domain list can be seen by clicking on the padlock icon in the URL.

3)    Multidomain SSL certificate: Multiple distinct domains can use a single certificate issued in the name of all the distinct domains. The domains are neither the sub-domain of a single domain nor the multiple pages of a single domain.

TLS/SSL HANDSHAKE:

(Image Source: https://www.geeksforgeeks.org/secure-socket-layer-ssl/)

Phase 1:  This is Establish Connection Phase. The client sends a ‘HELLO’ message with its TLS version, List of Cipher Suites and Random Client’s Number and the server replies with a ‘Hello’ message along with its SSL certificate, Cipher suite chosen and a Random Server’s number.

Phase 2: This is the Pre-secret master key Generation Phase. A client sends one more random string which is encrypted with a Public key (which is taken from Server’s SSL certificate), commonly called a ‘pre-secret master key’. The server decrypts this secret key with the private key of its certificate.

Phase 3: This is thesession key Generation Phase. The client as well as the server generates the session key using its own random numbers and pre-secret master key. The session key at both ends generated will be the same.

Phase 4: Handshake Ends. The session key will be verified and authenticated at both ends, it should be the same, then only a secure connection is established and the data moves now in an encrypted manner. If anyhow the key differs, the connection won’t be established. Once the connection is established both client and server send a ‘Finished’ message to each other and a green signal for encrypted data transfer will proceed.

This TLS/SSL handshake is validated till TLS1.2, in TLS 1.3 the handshake has been changed a little bit. In place of a 4-way handshake, it is now based on 2-step handshake validation or completed in just one round trip of a handshake. The TLS1.3 is more secure, encrypted and less time taking than all the previous versions.

UPGRADE IN TLSV1.3:

                              (Image Source: https://timtaubert.de/images/tls-hs-static-rsa.png)

Phase 1: Establish Connection. Same as TLS1.2 Phase 1, TLS1.3 also commences the handshake with the “Hello” message with an add-on of a list of supported cipher suites and a guess of which key agreement protocol will be chosen by the server along with the Client’s chosen key agreement protocol.

Phase 2: Validation Completion. The server replies with a “Hello” message with the key agreement protocol that it has chosen, key share, certificate and ‘Finished’ message.

The Server “Finished” message, which was sent in the 6^th step in the TLS1.2 handshake, is sent in the second step in TLS1.3. Thus, completing the round trip in just 2 steps.

Phase 3: Finished Message. In the last step, the client will validate the server certificate, and generate a key share while using the key of the server. Once all the checklists are done client sends a “Finished” message. Now, the data encryption begins.

Cipher Suite:  A complete set of cryptographic algorithms require to secure a network connection through SSL/TLS. For each set, there is a specific algorithm. The SSL/TLS does the Handshake process for building the secure connection and during the handshake, the client and the web server will use the following cipher suite components:

O  A key exchange algorithm is used to determine how symmetric keys in the handshake will be exchanged. Example: RSA (Rivert-Shamir-Adleman).

O  An authentication algorithm, which function is to tell how the authentication at both ends client as well as server will be implemented and finished. Example: DSA (Digital Signature Algorithm).

O  An Encryption cipher, to encrypt the data. Example: AES (Advanced Encryption Standard)

O  A Message Algorithm, a function is to check and administrate how the data integrity checks will be carried out. Example: SHA (Secure Hash Algorithm)