Modeling with UML

Use Case, Class, Sequence, Collaboration, State chart, Activity, Component and Deployment diagrams are used in UML. Describe each of the eight (8) main diagrams used in UML.

I refer to Wikipedia (2009) for the following descriptions.

Use Case diagram shows the functionality provided by a system in terms of actors, their goals represented as use cases, and any dependencies among those use cases.

Class diagram describes the structure of a system by showing the system's classes, their attributes, and the relationships among the classes.

Sequence diagram shows how objects communicate with each other in terms of a sequence of messages. Also indicates the lifespans of objects relative to those messages.

Collabration diagram displays an interaction organized around the objects and their links to one another. Numbers are used to show the sequence of messages.

State Chart diagram describes many systems, from computer programs to business processes with standardized notation.

Activity diagram represents the business and operational step-by-step workflows of components in a system. An activity diagram shows the overall flow of control.

Component diagram depicts how a software system is split up into components and shows the dependencies among these components.

Deployment diagram serves to model the hardware used in system implementations, and the execution environments and artifacts deployed on the hardware.

Use Case and Activity Diagrams help you to describe system functional requirements - it is important to note that the user may be a human or another software or hardware process. In either case it is referred to as an actor. Use Cases help with the problem of definition of requirements and analysis.

The following Use Case diagram shows a credit card processing system. The actors are the parties who interact with the system and the use cases are the functionalities of the system.

Actor: Customer, Shipping & Customer Service

Use Case: Update Order Staus, Update Inventory, View Outsatanding Orders, Get Product Information, Check Order Status, Add Product to Order Form, View Order Form, Place Order, Credit Card Rejected & Calculate Total.

Fig1. (Source: SmartDraw 2007 template)

The following Activity diagram shows the workflow of the Order Processing system. It starts with 'Place Order' and ends with 'Receive Order'.

Fig.2 ( Source: SmartDraw 2007 template)

Use a table (see below) to start your thinking, where business processes are taken from the SME and an object modelling table is used to help show development of your ideas, using very simple object modelling techniques. Here is a simple way to model your objects. Use the level 1 and 3 tables for designing any object in the e-business application:
Level 1 - User and system tasks table

Fig.3

Level 2 – Abstraction

The next step is called finding the level of abstraction, where the business objects build on each other to form classes from the most general and abstract – root class, to the more refined and concrete. What could be more concrete than an automatic telling machine (ATM)? Here the actor is human and the use case are withdraw cash; make a deposit; or request a balance.

Level 3 - Object description table

Use the level 3 table below to detail your design with the example used in object-oriented design.

Fig.4

Reference

Wikipedia 2009, Unified Modeling Language, Wikipedia, The free encyclopedia, last modified 15 June 2009, Wikimedia Foundation, Inc., US, viewed 17 June 2009, <http://en.wikipedia.org/wiki/Unified_Modeling_Language>.

TP monitors and transaction protocols

1.Give a description in your own words of the ACID properties of a transaction.

ACID stands for Atomicity, Consistency, Isolation & Durability which are the properties of a transaction. Atomic means that when a transaction is being executed, it is not interrupted by any other process from another transaction. Consistency means that a transaction must leave stored data in a consistent state until the whole (e.g. update) proccess has been completed. Isolation means that a transaction must not be interrupted by another transaction. Durability means that after a transaction has completed its operations, the results are reflected to the data (Ince 2005, pp.356-357).

2.Describe a TP monitor environment. How can a TP monitor stop an operating system being overwhelmed?

Normally, a TP monitor operates in a multi-thread system (e.g. mainframe computers or distributed client/server system) because it manages the concurrent execution of the threads and processes that make up a transaction and ensure that the ACID properties are enforced. It schedules threads so the low-priority transactions are allowed a smaller share of resources than high-priority transactions such as online transactions and enable load-balancing when an operating system is being overwhelmed (Ince 2005, pp. 363-364).

3.What is difference in load balancing with traditional and transactional MOM, RPC and conversations?
First of all, we need to have some undersrandings on these terminologies.

The process of sharing the processing load in a distributed system equally among the servers in the system, which is known as load balanacing (Ince 2005, p.386).

The process of executing code on a remote computer by invoking it from another computer often known as RPC (Ince 2005, p.259).

In Enterprise Javabean, message-oriented middleware (MOM) is a software which manages the transactions that pass from a client to a server and vice versa (Ince 2005, p.364).
In Enterprise Javabean, a conversation is a potentially long-running sequence of interactions (document exchanges) between multiple web services. In many situations, the backend logic triggered as part of these conversations may be transactional because of their transactional properties (Frolund, S and Govindarajan, K, n.d.).

Load balancing is a design to evenly distribute the resources among the servers. This is a server-side operation. The rest of them occur on both the client-side and the server-side operations.

4.Why is a two-phase commit protocol better than a one-phase atomic commit protocol?
One-phase atomic commit protocol can only ensure that all or none of the operations in a distributed transaction either commit or abort is to keep sending a commit or abort. Two-phase commit protocol can handle the operations of the nested transactions that one-phase atomic commit protocol can't handle. For example, a transaction that has many sub-transactions and each sub-transaction can make a decision to abort or provisional decision to commit to a transaction. A transaction will only commit if all its sub-transactions are provisionally committed. However, commitment can still occur even if some of its sub-transactions have been aborted. In order words, the sub-transactions can be aborted without causing their parent transaction to abort. This is because the parent transaction may contain code which handles any abortion of its sub-tansactions (Ince 2005, pp.358-360).

References

Ince, D 2004, Developing distributed and e-commerce applications, 2nd edn, Harlow, Essex, UK: Addison – Wesley, pp. 259,355-389.

Frolund, S and Govindarajan, K, n.d., Transactional Conversations, Hewlett-Packard Company, viewed 17 June 2009,<http://www.w3.org/2001/03/WSWS-popa/paper50>.

Concurrency terms

Find definitions for eight terms and concepts used in threaded programming:

Thread Synchronisation - This is a popular terminology used in the programming languages such as .Net, Java, Python and ...It means the coordination of multiple threads that must access shared data in Java language (Venners 1997).

Locks - This can ensure that only one thread at a time is given access to a resource (Ince 2005 pp.341-342).

Deadlock - This occurs when there is a contention between two transactions for two items of data and would occur in all distributed systems where there is shared access; however, in those systems where there are a number of clients which hold data for a long time (the typical interactive system) it is a major occurrence (Ince 2005, p.351).

Semaphores - This is a protected variable or abstract data type which constitutes the classic method for restricting access to shared resources such as shared memory in a parallel programming environment. A counting semaphore is a counter for a set of available resources, rather than a locked/unlocked flag of a single resource (Wikipedia 2009).

Mutex (mutual exclusion) - Mutex algorithms are used in concurrent programming to avoid the simultaneous use of a common resource, such as a global variable, by pieces of computer code called critical sections. A critical section is a piece of code where a process or thread accesses a common resource. The critical section by itself is not a mechanism or algorithm for mutual exclusion. In other words, Mutex is a not default algorithm in a program which includes critical sections (Wikipedia 2009).

Thread - A thread is anexecution of a chunk of code which can be carried out in parallel with the execution ofother chunks of code. On a computer with a number of processors the threads can beexecuted concurrently, with each instruction of each thread being executed at the sametime (Ince 2005, p.336).

Event - This is an action or a request that is usually initiated outside the scope of a program and that is handled by a piece of code inside the program. Typically events are handled synchronous with the program flow, that is, the program has one or more dedicated places where events are handled. In the threaded programming environment, when one event holds up the thread, the other thread can make use of the processor that has been forced to be idle. For example, a request for some data from a computer resident on a wide area network suchas the Internet (Ince 2005, p.336).

Waitable timer - According to Microsoft Developer Network (2009), Waitable Timer is a synchronization object whose state is set to signaled when the specified due time arrives. The operations of threads are prioritised by the timer objects.

References

Ince, D 2004, Developing distributed and e-commerce applications, 2nd edn, Harlow, Essex, UK: Addison – Wesley, pp. 336-373.

Microsoft Developer Network 2009, Waitable Timer Objects, Library, viewed 15 June 2009, http://msdn.microsoft.com/en-us/library/ms687012(VS.85).aspx>.

Venners, B 1997, 'How the Java machine performs Thread Synchronization' , JAVAWORLD, posted 1 July, viewed 14 June 2009, <http://www.javaworld.com/javaworld/jw-07-1997/jw-07-hood.html>.

Wikipedia 2009, Semaphores (Programming), Wikipedia, The free encyclopedia, last modified 5 June 2009, Wikimedia Foundation, Inc., US, viewed 14 June 2009, <http://en.wikipedia.org/wiki/Semaphore_(programming)>.

Wikipedia 2009, Mutual exclusion, Wikipedia, The free encyclopedia, last modified 4 June 2009, Wikimedia Foundation, Inc., US, viewed 14 June 2009, <http://en.wikipedia.org/wiki/Mutual_exclusion>.

Authentication and Encryption systems

1.Visit an e-commerce website and survey the mode of payment allowed. Would you trust the site with your business?

I have purchased goods from a few different e-commerce. Nearly all of them require me to settle the payments by a credit card. Just one or two can offer me an alternate payment method (e.g. paypal). To a great extent, I trust those e-commerce websites. Normally, I only purchase goods from the well-known companies such as Amazon, Symantec and other software distributors. Besies, I tend to use a virtual credit card with very low credit limit to make the payments because it would minimise the possible loss in case of fraud.

2.What measures should e-commerce provide to create trust among their potential customers? What measures can be verified by the customer?

Most of e-commerce websites have enabled SSL encryption to secure the communications between the websites and the clients. If the customer is able to view the web address begins with 'https' and the 'lock' image as illustrated below.

The website should have enabled the SSL encryption.


3.Visit the Verisign web site - what solutions does it offer for e-commerce?

Verisign offers a number of products and services to various types of customers. There are four main categories of its products.

• Consumer Authentication - protect consumer online identities and accounts with a trusted, convenient authentication experience and behind-the-scenes, real-time fraud detection.
• Enterprise Authentication - address business challenges and regulations around strong authentication, encryption, and digital signatures with secure and scalable PKI and OTP solutions.
• Government Authentication - PKI and OTP solutions for Federal, state, and local agencies and government contractors.
• Authentication for individuals - Digital signing, digital certificates and credentials for individuals and organizations to secure and protect online identities.
  

Not all of above are applicable to the e-commerce practice. Consumer Authentication would be designed for B2C e-commerce transactions and Enterprise Authentication is more for B2B e-commerce transactions.

4.Visit the TRUSTe web site. Describe what services and solutions are offered.

TRUSTe is an independent, privately held organisation which certifies the businesses with its Web Privacy Seal .and Email Privacy Seal. The following is the mission statement of TRUSTe.

TRUSTe helps consumers and businesses identify trustworthy online organizations through its Web Privacy Seal, Email Privacy Seal and Trusted Download Programs. TRUSTe resolves thousands of individual privacy disputes every year (TRUSTe n.d.).

In order to acquire a seal from TRUSTe, the busniesses need to meet the privacy rules set by TRUSTe as well as the legal requirements. However, some people just treat it as a marketinh tool rather a security benchmark (Cline 2003).

References

Cline J 2003, 'Web site privacy seals: Are they worth it?', Computerworld, network & internet, posted 8 May 2003, viewed 13 June 2009, <http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=81041>.

Truste n.d., Advancing Privacy and Trust for a Networked World, mission statement, viewed 13 June 2009, <http://www.truste.org/>.

VeriSign n.d., Products and Services, Verisign Inc., viewed 13 June 2009, <http://www.verisign.com/products-services/index.html>.

Pretecting and archiving data

1.What makes a firewall a good security investment? Accessing the Internet, find two or three firewall vendors. Do they provide hardware, software or both?


Ince (2005) notes that a firewall is an extra layer of protection placed around a network or around a particular application. A firewall placed around a network will usually employ a router which can be programmed to deny access to a network, for example it can be programmed to deny access to any packets of data which have been sent to a particular dedicated port. The following diagram illustrates the operation of a simple firewall.Figure 1 A Simple Firewall (Ince 2005 Fig. 11.2)

My firm employs Check Point and WatchGuard as the firewalls for different sites. I myself installed Norton 360 developed by Symantec Corporation on my home machines, which also has the firewall facility. These three firewall products can possibly meet the needs of users from different markets. Check Point is very popular software firewall for enterprises and WatchGuard is a hardware firewall welcomed by SMEs. Norton 360 is a home anti-virus software that also acquires the personal firewall.

2.Find out if your university or workplace has a backup policy in place. Is it followed and enforced?

My firm certainly has a backup policy which is thoroughly implemented. It has multiple backup devices including magnetic tapes and optical disks. They just barely meet our needs and are still manageable. Apart from that, everyday we used up a few backup tapes and optical disks and as time gone by we have accumulated a huge volume of them. Therefore, the metadata of tapes and disks are getting more and more important, which highly affects the recovery process. We all know that the recovery of data is very time consuming and never an easy task. However, we are usually required to fulfil the requests from users with a tight time frame. As a result, this is crucial to implement an effective backup and recovery solution with holistic view.

3.Most of the antivirus software perform an active scanning of the user activity on the Internet, detecting downloads and attachments in e-mails. Hackers have readily available resources to create new viruses. How easy is it to find a virus writing kit?

From the given website, it doesn't take long for someone to create a virus. I just recall what happened about 9 to10 years ago. The 'ILOVEYOU' virus successfully attacked tens and thousands of computers around the world. It created super email storms over the networks in order to give denial-of-service (Dos) attacks to email services. The virus wass actually a simple VB program. After we had analysed the source code of the program, my colleague worked out a solution within 24 hours. The solution was to cheat the virus that the machine had got infected and therefore, it would not execute itself. How? The infected machine would have been inserted a registry key by 'ILOVEYOU' and the virus only attacked the computers wiithout this key. We inserted this key to all computers on the network as a 'vaccine'. According to Wikipedia (2009), 'ILOVEYOU' infected10 percent of all computers connected to the Internet.

References

Ince, D 2004, Developing distributed and e-commerce applications, 2nd edn, Harlow, Essex, UK: Addison – Wesley, pp. 321-322

Wikipedia 2009, ILOVEYOU, Wikipedia, The free encyclopedia, last modified 28 May 2009, Wikimedia Foundation, Inc., US, viewed 12 June, <http://en.wikipedia.org/wiki/ILOVEYOU>.

Electronic payments and security II

1.What are cookies and how are they used to improve security?

Ince (2004) notes that 'a cookie is a file which is placed on a client running a browser and which usually contains details of a particular transaction, for example the products which someone has bought from an e-tailing site.'

According to Wikipedia (2009), there are a few uses of cookies.

• Cookies were introduced to provide a way to implement a shopping cart a virtual device into which a user can store items they want to purchase as they navigate the site.
• Cookies allow the server to know that the user is already authenticated, and therefore is allowed to access services or perform operations that are restricted to a user who is not logged in.
• Many websites also use cookies for personalization based on users' preferences.
• Some websites use the cookies to track internet users' web browsing habits for on-line advertising purpose (e.g. Google).

Users typically log in by inserting their credentials into a login page; cookies allow the server to know that the user is already authenticated, and therefore is allowed to access services or perform operations that are restricted to a user who is not logged in. In this sense, cookies become the authentication token of users' login.

2.Can the use of cookies be a security risk?

In general, a cookie itself is not dangerous. They may potentially infringe upon the host's privacy, but they are easily removed. A tracking cookie cannot cause any system instability. However, the use of cookies might trigger the following security risks.

• Inaccurate identification - this problem might arise when multiple users share the same user account on a computer.
• Cookie hijacking - attackers can use packet sniffing to steel the cookies which are being sent back and forth over the unencrypted http connections and then, intercept the cookies of other users and impersonate them on the relevant websites.
• Cookie theft - by design the cookie specifications constrain cookies to be sent back only to the servers in the same domain as the server from which they originate. However, the client-side scripts can redirect the values of cookies to a different server. Thus, the attackers can collect the cookies of other users.
• Cookie poisoning - while cookies are supposed to be stored and sent back to the server unchanged, an attacker may modify the value of cookies before sending them back to the server.
• Cross-site cooking - this is similar to cookie poisoning, but the attacker exploits non-malicious users with vulnerable browsers, instead of attacking the actual site directly. The goal of such attacks may be to perform session fixation.
• Inconsistent state on client and server - the use of cookies may generate an inconsistency between the state of the client and the state as stored in the cookie. If the user acquires a cookie and then clicks the "Back" button of the browser, the state on the browser is generally not the same as before that acquisition.
  

References

Ince, D 2004, Developing distributed and e-commerce applications, 2nd edn, Harlow, Essex, UK: Addison – Wesley, pp. 305-306.

Wikipedia 2009, HTTP cookie, Wikipedia, The free encyclopedia, last modified 3 June 2009, Wikimedia Foundation, Inc., US, viewed 7 June 2009,<http://en.wikipedia.org/wiki/Intrusion_detection_system>.

Electronic payments and security I

1.List and describe your experiences with a secure Web site.

Very often I use online banking services to settle my bills and manage my financial transactions. HSBC online banking website adopted two-factor authentication and is equiped with EV SSL certificates. Not only I need to logon it with my user id and password but also, enter a one time password generated by the given hardware token. The password is only effective for 15 seconds.

I have experience of purchasing goods from Amazon. When I make a payment for the selected items, I will have to sign in the secure server for processing the transaction. Hypertext Transfer Protocol Secure (HTTPS) is adopted in the payment module of the Amazon website. There are a few methods to settle the payment. I have chosen the credit card option in my account since day one.

2.What is SET and how does it compare to SSL as a platform for secure electronic transaction? Is SET in common use?

Secure Electronic Transactions (SET) is a protocol which is used for sending credit card information over the Internet. It consists of three major components: Electronic Wallet, SET Server and Payment Server. For details, please refer to my previous blog entry.

Both SET and SSL employed Cryptography to secure the information exchanged over the Internet. This would be tremendous important for online transactions. SET was launched in 1996 but was not very popular in the market even though 'SET was ultimately the strongest technology for securing online payments, businesses tended toward the less sophisticated models as a means of establishing for themselves an online presence' (Free Encyclopedia of Ecommerce n.d.).

Wikipedia (2009) explains why SET could win the market due to the following factors:

• Network effect - need to install client software (an e wallet).
• Cost and complexity for merchants to offer support and comparatively low cost and simplicity of the existing SSL based alternative.
• Client-side certificate distribution logistics.

Free Encyclopedia of Ecommerce (n.d.) also claims that SET is a sophisticated model but users favour the less sophisticated model, SSL. Nowadays, SSL has been the most popular protocol for securing e-commerce transactions. Lee, Malkin & Nahum (2007) have evaluated the adoption and evolution of Secure Sockets Layer (SSL)/ Transport Layer Security (TLS) through 19,000 servers. Most of the well-known e-commerce sites (e.g. Amazon, Buy.com), auction sites (e.g., eBay), on-line banking (e.g., Citibank, Chase), stock trading (e.g., Schwab), and even government (e.g., irs.gov) have adopted the SSL protocol. Communication with these sites is secured by SSL or its variant, TLS, which are used to provide authentication, privacy, and integrity. A key component of the security of SSL/TLS is the cryptographic strength of the underlying algorithms used by the protocol. It is crucial to ensure that servers using the SSL protocol have employed it properly. The adoption rate of SSL 3.0 is very positive.The on-going developments of SSL/TLS really enable them to win the e-commerce market.

References

Free Encyclopedia of Ecommerce n.d., Secure Electronic Transaction (SET), <http://ecommerce.hostip.info/pages/925/Secure-Electronic-Transaction-SET.html>.

Lee HK, Malkin T & Nahum E 2007, 'Cryptographic strength of ssl/tls servers: current and recent practices', Internet Measurement Conference: Proceedings of the 7th ACM SIGCOMM conference on Internet measurement, San Diego, California, USA, pp.83-92, also available as pdf file, <http://www.imconf.net/imc-2007/papers/imc130.pdf>.

Wikipedia 2009, Secure Electronic Transaction, Wikipedia, The free encyclopedia, last modified 1 April 2009, Wikimedia Foundation, Inc., US, viewed 7 June 2009, <http://en.wikipedia.org/wiki/Secure_electronic_transaction>.