mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
95 lines
2.0 KiB
TeX
95 lines
2.0 KiB
TeX
\section{Security Architecture}
|
|
|
|
|
|
\subsection{Password Security}
|
|
|
|
Passwords are hashed using Argon2id:
|
|
|
|
\begin{equation}
|
|
\text{hash} = \text{Argon2id}(\text{password}, \text{salt}, t=3, m=64MB, p=4)
|
|
\end{equation}
|
|
|
|
Parameters:
|
|
\begin{itemize}
|
|
\item $t$ = 3 iterations
|
|
\item $m$ = 64 MB memory
|
|
\item $p$ = 4 parallel threads
|
|
\end{itemize}
|
|
|
|
\subsection{Session Management}
|
|
|
|
Secure session handling:
|
|
|
|
\begin{lstlisting}[language=C]
|
|
type Session struct {
|
|
ID string `json:"id"`
|
|
UserID string `json:"user_id"`
|
|
Token string `json:"token"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
ExpiresAt time.Time `json:"expires_at"`
|
|
IPAddress string `json:"ip_address"`
|
|
UserAgent string `json:"user_agent"`
|
|
}
|
|
|
|
func (s *Session) IsValid() bool {
|
|
return time.Now().Before(s.ExpiresAt)
|
|
}
|
|
|
|
func (s *Session) Refresh() {
|
|
s.ExpiresAt = time.Now().Add(30 * time.Minute)
|
|
}
|
|
\end{lstlisting}
|
|
|
|
\subsection{CSRF Protection}
|
|
|
|
Double-submit cookie pattern:
|
|
|
|
\begin{lstlisting}[language=C]
|
|
func CSRFMiddleware() gin.HandlerFunc {
|
|
return func(c *gin.Context) {
|
|
token := c.GetHeader("X-CSRF-Token")
|
|
cookie, _ := c.Cookie("csrf_token")
|
|
|
|
if token == "" || token != cookie {
|
|
c.AbortWithStatus(403)
|
|
return
|
|
}
|
|
|
|
c.Next()
|
|
}
|
|
}
|
|
\end{lstlisting}
|
|
|
|
\subsection{Rate Limiting}
|
|
|
|
Token bucket algorithm for API rate limiting:
|
|
|
|
\begin{equation}
|
|
\text{allowed} = \begin{cases}
|
|
\text{true} & \text{if } \text{tokens} > 0 \\
|
|
\text{false} & \text{otherwise}
|
|
\end{cases}
|
|
\end{equation}
|
|
|
|
Where tokens are replenished at rate $r$ per second with maximum capacity $b$.
|
|
|
|
\subsection{Audit Logging}
|
|
|
|
Audit trail format:
|
|
|
|
\begin{lstlisting}[language=json]
|
|
{
|
|
"timestamp": "2024-01-15T10:30:00Z",
|
|
"event_type": "authentication",
|
|
"user_id": "user-123",
|
|
"ip_address": "192.168.1.1",
|
|
"user_agent": "Mozilla/5.0...",
|
|
"action": "login_success",
|
|
"metadata": {
|
|
"mfa_used": true,
|
|
"authentication_method": "webauthn"
|
|
}
|
|
}
|
|
\end{lstlisting}
|
|
|