International Journal of Advancements in Research & Technology, Volume 4, Issue 8, August -2015 ISSN 2278-7763 78 SECURITY VIOLATION MANAGEMENT IN CLOUD BASED E-COMMERCE NETWORK USING PROCEDURAL SERVICE TAGGING TECHNIQUE Mbachu C.B¹. Chukwurah E.E ², Okafor K.C. ³ 1,&2 Department of Electrical and Electronic Engineering, Anambra State University, Uli.Anambra State, Nigeria 3 Department. of Electrical Electronic Engineering, Federal university of Technology, Owerri, Imo State Nigeria Email:dambac614@gmail.comk 1, messiahmessiah9@yahoo.com ², kennedy.okafor@futo.edu.ng ³ Abstract E-Commerce platform represents a computation environment for myriads of web buying and selling transactions on demand. Interestingly, the system architecture for e-commerce domain forms a vulnerable point for hackers and malicious users. Existing security modules have focused on the application front-end for users taking cognizance of the integration logic and the server back-end. Various encryption algorithms proposed to protect the users and the administrators are insufficient to address this challenge, hence this work that discuses and analysed a secured e-commerce design from a network perspective, that used Procedural Service Tagging Technique (PPTS ) as a technique that tags IP address labels of registered e-commerce users on the e-commerce server platform via a robust stateful firewall. An experimental testbed was developed for the e-commerce Network Operation Centre. In the setup, the Integrated Service Router (ISR) firewall monitors the ingress packets as well as the egress packets while obtaining information about the available IP tags on each of its interfaces. It was concluded that the PPTS is most accurate approach as it facilitates the collection of information from all possible sources at the highest possible frequency by the ISR firewall. This approach can be very efficient in terms of stateful monitoring on the e-commerce domain. IJOART Key Words: E-Commerce, Procedural Service Tagging Technique (PPTS ), Combined-input Crosspoint-Queued (CICQ) firewall, IP Spoofing , Cloud Datacentre, Encryption. 1. INTRODUCTION E-Commerce offers an easy way of direct access for online business transactions aimed to reduce the rigour of carrying out physical cash payment, direct involvement of parties in the business schedules of the present days marketing system. The online marketing system for the fast technologically growing population of the world should be guarded and secured for reliability and accessibility. Effective use of ecommerce should be guaranteed by the need to incorporate securities that will identify not just usernames and passwords, show list of users at a point in time, and be able to disable users for any evidence of wrong use of pass codes or activities likely to be frauds, but should be able to adequately protect the backend servers offering the e-commerce service. This will go a long way to encouraging e-commerce users to be actively involved in online business transactions. For this to be achieved, a cloud datacentre [1] is needed with a designed portal that allows users for secured interactivity on the internet cloud via an e-commerce Software as a Service (SaaS) application model called Cloud E-commerce System (CES). 1.1. Cloud Datacenter Description A cloud datacentre is a server farm or a computer room where majority of enterprise servers and storage systems such as Enterprise Resource Planning solutions (ERPs), Application servers, e-commerce servers, Copyright © 2015 SciResPub. Security systems (IDS) are located, operated and managed. It is also referred to as the consolidation point for provisioning multiple services that drive enterprise business processes [2]. For example, financial institutions like banks, educational institutions like universities, internet service providers (ISPs), internetbased social networks, oil and gas industries all have one form of data centre or the other where their data are stored, operated and managed. Some of them have and manage their own datacentres while others outsource to bigger datacentres due to high cost of owning, managing and maintaining a data centre networks [2]. A datacentre can be cloud based or non-cloud based depending on its layers of integration. Datacentres, behaving as “cloud providers”, are computing infrastructures which provide many kinds of agile and effective services to customers. Organizations such as Amazon, Cisco, Yahoo, Salesforce, Facebook, Microsoft and Google have their own datacentres and provide pay-as-you-go cloud services. The cloud datacentre offers two major services: One is on-demand computing instance e.g. Amazon’s EC2 and Eucalyptus, and the other is on-demand computing capacity. The former provides computing instances according to needs. The datacentres instantly create virtualized instances and give the response. The virtualized instance might consist of processors running at different speeds and storage that spans different storage systems at different locations. Therefore, virtualization is an essential characteristic of cloud computing, through IJOART International Journal of Advancements in Research & Technology, Volume 4, Issue 8, August -2015 ISSN 2278-7763 79 1.2. Our Contribution In this work the aim is to develop an e-commerce network system for a secured online business transaction running on the cloud IP backbone leveraging the concept of Procedural Service Tagging Technique for packet monitoring. key and public key encryption algorithms used for access authentication. In context, the generated symmetric key is used for integrity encryption for the authentication access in ISCloud V.1.0 SaaS model. The issues of gateway vulnerabilities were not addressed. The work in [8] developed a new encryption scheme based on XAMP MD5 Random Curve Cryptography (XMD5 – RCC) running on Secure Socket Layer (SSL) which protects the user and administrators on the Ecommerce platform. The result of encryption scheme randomly generates and secures the login details dynamically on the server during the authentication and authorization phases. The work in [9] discussed security trust in Online Service Computing while developing a Secured-tier VLAN for e-commerce systems. Similarly, the authors in [10] presented a new conceptual model for online trust, which illustrates the phases of building online consumer trust and outlines the necessary interactions between consumers, and the vendors. Various security contributions have been made in literature with respect to cloud based networks. A representative sample of literature studies on cloud security efforts in relation to cloud based platforms for privacy protection on the internet are detailed in [11],[12], [13],[14],[15],[16],[17], [18] and [19]. These works focused more on cloud security using various related security algorithms and strategies to protect enterprise assets and critical infrastructure on the cloud computing network. Though their emphasis was not on e-commerce domain. The work in [20] demonstrates the tasks needed to enhance the network security in Linux environment. The work specified a total of seven configurations and security levels of firewall, according to the requirements stated in documented security policies. In [21], the authors present an assessment methodology to analyse the performance of different firewalls platforms. The analysis considers the following metrics: delay, jitter, throughput, and packet loss. The information security of the firewalls was tested by applying a set of attacks and observing the reaction of the firewalls. Their proposed assessment methodology was tested by performing real experiments on different types of firewalls including those that are personal and networkbased. Furthermore, the authors in [22] experimentally evaluated and model the error-caused security vulnerabilities and the resulting security violations of two Linux kernel firewalls: IPChains and Netfilter. There were two major aspects to their proposal viz: extensive error injection experiments on the Linux kernel and the quantification the possibility of errorcaused security violations using a SAN model. 2. LITERATURE REVIEW 2.1. Summary of Related Works Authors in [7] present ISCloud V.1.0, an interactive cloud shopping cart based SaaS with Hybrid Cryptography in which a fast high-quality symmetric- 2.2. Limitation of Existing Works 1. Most of the works focused on the Software as a Service model which is highly vulnerable to attacks. 2. Most of these models lack multi-tier security functionality to address possible vulnerability issues. which applications can be executed independently without regard for any particular configuration [3]. Equipped with similar machines, datacentres can scale out by providing additional computing instances, or can support data- or compute-intensive applications via scaling capacity. Google and Yahoo belong to the second category. In these datacentres, the need of processing large amounts of raw data is primarily met with distributed and parallel computing and the data can be moved from place to place and assigned changing attributes based on its lifecycle, requirements, and usefulness [3]. In this regard, one core technology is MapReduce which serves as a style of parallel programming model supported by capacity-on-demand clouds. It can compute massive data in parallel on a cloud services. Cloud computing services are classified into two distinct deployment models amongst others, viz: public and private [4]. A public cloud is designed to provide cloud services to a variety of third-party clients who use the same cloud resources. Public cloud services such as Google’s App Engine are open to anyone at anytime and anywhere. On the contrary, a private cloud is devoted to a single organization’s internal use. Google, for example, uses Google File System (GFS), MapReduce, and BigTable as part of its private cloud services, so these services are only open inside the enterprise. It is important to note that Google uses its private cloud to provide public cloud services, such as productive applications, media delivery, and social interaction [3]. Other models are the community and hybrid clouds [4]. These cloud networks [5] aim to power the next generation datacentres by exposing them as a network of virtual services (hardware, database, user-interface, application logic) so that e-commerce users are able to access applications from anywhere in the world on demand at a costs depending on users QoS (Quality of Service) requirements [6]. Some of the traditional and emerging cloud-based applications include social networking, web hosting, content delivery, and real time instrumented data processing. Each of these application types has different composition, configuration, and deployment requirements. The issue with the cloud infrastructure for deploying e-commerce application is the vulnerability of the network infrastructure. IJOART Copyright © 2015 SciResPub. IJOART International Journal of Advancements in Research & Technology, Volume 4, Issue 8, August -2015 ISSN 2278-7763 3. In most of the systems, their modularization design lacks the capability for audit trails and logs for transaction computations 4. Integration is highly capital intensive making it difficult to be adopted. 5. Heavy and complex cart models makes for inflexibility making difficulty in user experience and the encryption algorithms are not properly integrated.etc. 6. Integrated firewall service is usually placed in front of the servers which presents vulnerable point for attackers. 2.3. Benefits of e-Commerce Network Considering the e-commerce network security framework discussed in section 3, this work outlines the advantages of the proposed model below, viz: i. Cost savings. Depending on the specific mix of applications, and network configuration, MPLSbased services can reduce costs by 10% to 25% over comparable data services (frame relay and ATM). As companies add voice and video traffic, cost savings can rise to as much as 40% network wide. ii. Quality of service (QoS) enablement. One of the primary benefits of ISR based firewall services is the ability to support QoS for end users. iii. . Improved performance. Because of the any-to-any nature of ISR services, network designers can reduce the number of hops between network points, which translates directly to increased response time and improved application performance. ISR firewall labels are used to forward the packets instead of the destination IP address. iv. Disaster recovery. ISR-based services improve disaster recovery in a variety of ways. First and foremost, data centres and other key sites can be connected in multiply redundant ways to the cloud (and thus to other sites on the network). Secondly, remote sites can quickly and easily reconnect to backup locations if needed (unlike with ATM and frame networks, in which either switched or backup permanent-virtual-circuits are required). V. Unified network infrastructure vi. Better integration of various forms of IP traffic vii. Flexible classification of packets viii. Optimization of network resources with optimal traffic flow 80 ii. Optimized Speed The proposed model greatly speeds up the tagging process by labelling each packet as it arrives on the network. Each network router stores information on how to handle different packet types, as indicated by their header label. This directly translates to higher efficiency by lightening the load on an organization's routers and freeing up needed resources. Speed of packet transmission is increased as the load on network infrastructure is reduced. Consequently, the proposed model used the user IP traffic to secure users on the cloud e-commerce domain. All of this is done seamlessly, with absolutely no interaction needed on the part of the customer and with no significant changes to their network infrastructure. 3. METHODOLOGY 3.1. Procedural Service Tagging Technique (PSTT) After several field visitation and literature studies, this work developed a PSTT as a tag labelling method of identifying every user that registered on the cloud ecommerce portal. The control plane of the firewall switching module in figure.1 uses a combined-inputand-crosspoint-queued (CICQ) architetcure. The functional block diagram of the controller unit supports ingress IP and Egress IP that is labelled as an access and trunk traffic. With a label on the user IP, the packet processing unit will check whether it is directed to a valid e-commerce server. In this case, the tag remover unit will remove the tag information and checks the address of the destination server and the port location associated with this address will be taken from the lookup table. The packet processing unit uses the following algorithm: a) If the user IP is directed to a node within the same controller Cij, then the processing unit will close the proper crossbar port to forward the user IP packet to the required destination output buffer. b) If the packet is not within the same controller, the IP packet processing unit will add the tag information and direct it to the output trunk buffer. IJOART 2.4. Implications of the Proposed e-Commerce Network The proposed model is a form of IP labelling. Other functional features includes: i. User Packet Labelling In this work, the proposed ISR model is designed to label user IP packets. In traditional IP networks, packets are routed based solely upon the data's network-layer header. But in the proposed model, the arrival of each packet forces a router to decide where it should go next with no regard for its actual content. Copyright © 2015 SciResPub. IJOART International Journal of Advancements in Research & Technology, Volume 4, Issue 8, August -2015 ISSN 2278-7763 81 Figure 1: A Model of CICQ Firewall Architecture are then forwarded towards the appropriate node based on the forwarding decision. Figure 1 shows the model of the combined-input crosspointqueued (CICQ) firewall architecture, with inputs Ai, outputs QN , and crosspoint buffers BiN . Figure 2 shows the interaction of the IP spoofing algorithm on the secured e-Commerce network. Users are identified by the label tags on them once they register on the application portal. The location of the users is considered as the internet platform allows seamless remote communication as shown in Figure 3. Figure 4 Stateful ISR firewall based on IP Label tagging IJOART Figure 2: Proposed Secured E-Commerce Network Figure.3: Proposed Conceptual Location Network Model 3.2. Network Access Firewall (NAF) Figure 4 shows a typical network access firewall (NAF) based on Cisco Integrated Service Router (ISR) series router. In this router, the control plane (control component) maintains and controls the forwarding table by learning the network topology from the routing protocols such as OSPF, IS-IS and BGP. Control plane is responsible for building the MPLS IP routing control by updating the label bindings which are exchanged between the routers. So when a user IP packet arrives at the router, the forwarding decision is taken by the data plane (forwarding component) by consulting the forwarding table, which is maintained by control plane. The packets Copyright © 2015 SciResPub. 4. SYSTEM IMPLEMENTATION 4.1. Capacity Modelling in e-Commerce Cloud Network Architecture The approach for capacity estimation is based on the use of Equations (1),( 2) and (3). The e-commerce NOC requires the ISR firewall to supply the ingress Ip or egress Ip and obtain the information about the available IP tags on each of its interfaces. The most accurate approach will be to collect information from all possible sources at the highest possible frequency allowed by the ISR update interval constraints. This approach can be very efficient in terms of signalling and data storage. Furthermore, it can minimize traffic redundancies, memory requirements for data storage and the signalling effort for data retrieval. This work now models the capacity requirement for the system. Lets define for a link between two nodes Xk and Yk: Let the input firewall gateway capacity be given by Lp = (1) Let the output firewall gateway capacity be given by KP = (2) Where j,n are integer values, IPU is the available bandwidth, Xk is the input vector (Ingress) While yk is the output vector (Egress). Hence, the ISR firewall cloud network capacity is given by Cp = Lp + KP (3) This paper will now discuss the implementation of the secured e-commerce cloud network. In production context, the system design will leverage third party cloud technologies and services offerings including (a) IJOART International Journal of Advancements in Research & Technology, Volume 4, Issue 8, August -2015 ISSN 2278-7763 VM technologies such as open source Xen and commercial VMWare for e-commerce server virtualization. In the simulation environment, this work implemented a scenario based connection in the platform as a Service (PaaS) to allow full system interaction. 4.2. Experimental Testbed In this work, the design of the proposed system used Riverbed Modeller software [23] to achieve the design. For the network test bed, the following infrastructure components were used, viz: i. 10 User locations ii. 12 local Switches with VLAN Service iii. 1000 (Min) e-commerce Users (Client Stations) iv. 1 ISR Unix/Checkpoint Cloud Firewall v. 9 e-Commerce Serves each on PPP DS1 and 10Gbps Links vi. Http User Traffic based on user IP on web browser vii. 1 large pool of Internet Cloud. From figure 2, the proposed secured e-commerce network system model utilizes the infrastructure components outline above. The e-commerce servers have the role authenticating and monitoring the overall network for efficient service delivery. The switches enable localized connectivity. 82 are used for connecting client and server nodes to the switches and servers. Figure 7 shows the capacity response times for a firewall scenario of stateful PSTT and non stateful PSTT. It was shown that the proposed security scheme is stable while offering better system response even in attack scenario. The lower latency of 0.5secs at steady state means that the system have the capacity to monitor myriad of traffic without any overhead on the network performance. IJOART Figure 6. Validation compilation of the e-commerce design architecture with Riverbed Modeller tool Figure 5. 2800 series gateway router (Source: Federal Ministry of Science and Tech, NASENI-ELDI, Testbed, Awka, 2015) 5. SYSTEM EVALUATION The network model, node model and process models were accomplished in the testbed using Riverbed modeller. After setting up the model, a simulation run was carried out to verify the architecture shown in figure2. The validation plot is shown in figure 6 verified the consistency test carried out. Also, the plot shows that the model design is stable and consistent before simulation execution. In the model, Ethernet links were used to connect all the firewall and 10GB Mbps links Copyright © 2015 SciResPub. Figure 7: Validation Comparison of capacity modelling between PPTS Firewall response times and Non- PPTS Firewall By employing a security model that will balance security effectiveness with productivity, a stateful firewall with a comprehensive range of next-generation network security services, including granular visibility and control, robust web security onsite or in the cloud, IJOART International Journal of Advancements in Research & Technology, Volume 4, Issue 8, August -2015 ISSN 2278-7763 and intrusion prevention to protect against known threats, threats and advanced malware, this will provide comprehensive visibility, reduced cost and complexity, and real-time protection from malware and emerging threats in the ecommerce domain. 6. CONCLUSION AND RECOMMENDATION In this work, secured e-commerce cloud architecture was proposed as an optimal network for cloud based ecommerce applications. An exhaustive literature search was carried out showing the limitation of existing systems. The system model for the proposed system was discussed, the advantages and prospects was outlined. A validation design was achieved with Riverbed Modeller software Version 15.0 showing a stable operation and lower response times for secured e-commerce context. Future work will show cloud based security network using Cisco ASA 5500-X series in a production environment. The performance in a single user case will also be compared with multi-user scenario. With this model, the future of e-commerce is highly secured. 83 6. R. Buyya, C. S. Yeo, and S. Venugopal. Market oriented cloud computing: Vision, hype, and reality for delivering IT services as computing utilities. Proceedings of the 10th IEEE International Conference on High Performance Computing and Communications, 2008. 7. Okafor, K.C, Udeze C.C, Okafor C.M, “ISCLOUD V.1.0: An Interactive Cloud Shopping Cart Based On Software As A Service Computing Model With Hybrid Cryptographic Algorithm” International Journal Of Engineering And Computer Science ,Volume 2 Issue 6 June, 2013 Pp.No. 17271738. 8. N.kafor, F.N.Ugwoke, Okafor K.C, Udeze,C.C, “3-Tier EComP: A Novel ECommerce Management Portal Based on Secured Software Development Life Cycle Approach”, In Computing, Information Systems, Development Informatics & Allied Research Vol. 4 No. 4 December, 2013, Pp.111. 9. A.C Okafor, Okafor K.C, Ugwoke.F.N, Osuesu B. O., Ogbu V. I. “Online Service Computing Using VLAN Design Architecture in American Journal of Computer Science and Information Engineering, (AJCSIE),USA,2014, 1(3), Pp.10-23. 10. A.C. Okafor, H. C Inyiama, K.C. Okafor, C. C.Okezie, O.B Obianuju,“ A Model for Improved Online Service Process Computing; A Case For Vlan Online Shop Integration”, In International Journal of Innovative Science Engineering and Technology (IJISET), Vol 2.Issue 4, 2015 India. 11. A.Awasthi, A.Vajpayee, P.Yadav, “Crypto Cloud Computing The C3 model”, International Journal of Emerging Technology and Advanced Engineering (IJETA), Vol.2, Issue 9, Sept. 2012,Pp. 448-456. 12. D.Yuefa, W. Bo, G.Yaqiang, Z. Quan, T.Chaojing, “Data Security Model for Cloud Computing”, In Proc. of the 2009 International Workshop on Information Security and Application (IWISA 2009), Pp.141-144. 13. Sh. Ajoudanian and M. R. Ahmadi,”A Novel Data Security Model for Cloud Computing”, IACSIT International Journal of Engineering and Technology, Vol. 4, No. 3, June 2012,pp.326-329. 14. Kangchan Lee, “ Security Threats in Cloud Computing Environments”,International Journal of Security and Its Applications Vol. 6, No. 4, October, 2012, pp.25-32. 15. R.P.Padhy, M.R.Patra, S.Chandra Satapathy, “ Cloud Computing: Security Issues and Research Challenges, IRACST - International IJOART References 1. Okafor K.C, Ugwoke, F. N, Udeze, C. C, 2. 3. Okezie, C. C, O. U Oparaku, “Gateway Load Balancing Service In Cloud Data Centre Environments Using Throughput Metric Index”, In American Journal of Computation, Communication and Control, (AJCCC), AASCIT, USA, 2014; Vol.1 , No. 1, April 2014, pp.8-17, 2014. C.C.Udeze, Okafor K.C, C.C.Okezie, I.O.Okeke, .G.C.Ezekwe, “Performance Analysis of R-DCN Architecture for Next Generation Web Application Integration”, In IEEEXplore, 6th IEEE International Conference on Adaptive Science & Techonology (ICAST 2014), Covenant University Otta, 19th-31st, Oct,2014.Pp.1-12. K.C.Okafor “A Model for Smart Green Energy Management Using Distributed Cloud Computing Network”, Ph.D. Thesis, University of Nigeria Nsukka.2015 4. F.N.Ugwoke, K.C Okafor, C.C.Udeze, I.M.Onwusuru, “HH-CLOUD: A Network Based Knowledge Management Framework for R&D Organizations in Nigeria”, In the Proc. of 25th National Conference: Building a Knowledge-Based Economy in Nigeria: The Role of IT, July 23rd – 25th, Enugu, 2014.Vol 25. Pp.20-31. 5. A. Weiss. Computing in the NetWorker, 11(4):16–25, Dec. 2007. Copyright © 2015 SciResPub. clouds. IJOART International Journal of Advancements in Research & Technology, Volume 4, Issue 8, August -2015 ISSN 2278-7763 16. 17. 18. 19. 20. 21. 22. 23. 84 Journal of Computer Science and Information Technology & Security (IJCSITS) Vol. 1, No. 2, December 2011, Pp.136-146. K.Hashizume, D.G.Rosado, E.FernándezMedina and E.B.Fernandez, “An analysis of security issues for cloud computing”Journal of Internet Services and Applications 2013, 4:5, Pp.1-13. Mughele E.S, Ibitola A., Okunoye, A, “Enforcing Security On Cloud Computing Network: A Theoretical Frame Work”, Computing, Information Systems & Development Informatics Vol. 4 No.1 March, 2013, Pp.64-72. P.G L, M.Prateek, and I.Singh Data Security Algorithms for Cloud Storage System using Cryptographic Method, International Journal of Scientific & Engineering Research, Vol 5, Issue 3, March -2014 , Pp.54-61. I.E. Achumba, K.C.Okafor, G.N. Ezeh, U.H.Diala, “OpenFlow Virtual Appliance: An Efficient Security Interface for Cloud Forensic Spyware Robot” International Journal of Digital Crime and Forensics, 7(2), 31-52, April-June 2015. S.Taluja, P.K.Verma, R.L Dua, “Network Security Using IP firewalls,“International Journal of Advanced Research in Computer Science and Software Engineering, Vol 2, Issue 8, August 2012, Thaier Hayajneh, Bassam J. Mohd , Awni Itradat, and Ahmad Nahar Quttoum, “Performance and Information Security Evaluation with Firewalls, International Journal of Security and Its Applications Vol.7, No.6 (2013), pp.355-372 http://dx.doi.org/10.14257/ijsia.2013.7.6.36. S.Chen, J.Xu, Ravishankar K.Iyer, Keith Whisnant, “Evaluating the Security Threat of Firewall Data Corruption Caused by Instruction Transient Errors. In Proceedings of the 2002 International Conference on Dependable Systems & Network, Washington, D.C., June 23-26. www.riverbed.com-Online: https://supportstaging.riverbed.com/bin/suppor t/static//doc/opnet/17.5.A/online/itguru_17.5.P L5/Models/wwhelp/wwhimpl/common/html/ww help.htm#href=Applications_M odel_desc.02.05.html&single= IJOART Copyright © 2015 SciResPub. IJOART