A Study on Security Technique of Cloud Data Processing in Electronic Commerce

Transcription

1 Internatonal Journal of Securty and Its Applcatons, pp A Study on Securty Technque of Cloud Data Processng n Electronc Commerce We Da 1, Xuefang Zhang 2 and Peng Hu 3 1 School of Economcs and Management, Hube Polytechnc Unversty, Huangsh , Hube, P.R.Chna 2 School of Economcs and Management, Hube Polytechnc Unversty, Huangsh , Hube, P.R.Chna 3 School of Mathematcs and Physcs, Hube Polytechnc Unversty, Huangsh , Hube, P.R.Chna 1 dwesky@163.com, 2 zxf1223@126.com (Correspondng Author), 3 penghut@163.com Abstract In the age of e-commerce, the ssue of nformaton leakage of nternet users s a wde concern. The e-commerce enterprses should be prepared to deal wth network data processng securty, and to avod varous nconvenences led by the loss of data nformaton. In ths study, the "busness to customer" (B2C) cloud data processng model s taken as an example to propose a securty countermeasure for network data processng based on cloud computng platform. The cloud network computng model s adopted for the automated processng on B2C network data. Based on the network overlappng relatonshp and model settngs, the securty workflow of the cloud data computng processng s bult. Moreover, the overlappng network plan and flow network technque are consdered as the bass of the model, and a dversfed securty control platform s created by combnng wth modelng tools. Keywords: E-commerce, Cloud data, Informaton leakage, Securty control 1. Introducton The global trade and economy s rsng n recent years. Commercal trade has become the man trend of the market n many countres. Moreover, technology trade s the development trend of the global economc reform. Ths s due to the regonal openness of Internet platform. Varous types of commercal trade networks [1-4] have appeared on the Internet platform and promote the vrtualzaton constructon of economc transacton actvtes. As one of the earlest e-commerce platform n Chna, "busness to customer" (B2C) has dffculty to get rd of customer nformaton securty rsks n the long term, whch has made massve leaks of customer nformaton and brought about a plenty of transacton securty ssues. In order to promote the sustanable development of e-commerce webstes, t s necessary to adopt new technologes to address the securty ssues of customer nformaton and to create a safe and relable nternet transacton envronment for both busnesses and customers. 2. Current Status of Informaton Securty of E-Commerce Webstes There are varous factors leadng to customer nformaton leakage of e-commerce webstes ISSN: IJSIA Copyrght c 2014 SERSC

2 Internatonal Journal of Securty and Its Applcatons based on B2C platform [5, 6]. A lot of B2C e-commerce webstes do not pay suffcent attenton to the confdentalty of customer nformaton. Besdes, the staff moblty of these webstes s hgh, and hence there have already been plenty of customer nformaton leakage cases caused by the staff of B2C e-commerce webstes. The applcaton feld of e-commerce technology s gradually expandng, and the e-commerce networks are facng the stuaton of growng data traffc. Therefore, a sngle e-commerce platform can no longer satsfy the data processng requrements. As the host platform of e-commerce webste, cloud computng network [7, 8] encounters dfferent data operaton problems when processng e-commerce data, thereby ncreasng the data nformaton securty rsks. 3. Survey on Customer Informaton Leakage of Jngdong Mall E-commerce s created n the context of vrtualzaton of global commercal trade. Under E-commence, the transactons are completed through browser or server. It can be seen from the ncdents of customer nformaton leakage of Jngdong Mall that the attacker drectly extracted customers' personal nformaton from the backstage of Jngdong, whch means that there are two stuatons leadng to such ncdent. The frst one s that the attacker found the vulnerablty of the web server and drectly nvaded the server to steal the customer personal nformaton. The second s that before the attacker attacked the ste, he found who wanted to attack the e-commerce webste va an llegal underground ndustry chan lke customer nformaton traffckng, and then he sneaked nto the company as an employee, worked for some tme and stole customer nformaton by settng the backdoor. The specfc forms of loophole are shown n Table 1. Table 1. Jngdong Mall Loophole Type Statstcs Loophole type XSS scrptng attacks SQL necton Command executon Unauthorzed access Desgn flaw Others Percentage 25% 12% 8% 15% 15% 25% So far, wth the development of "busness to customer", whch s the earlest e-commerce model n Chna, t has great nfluence on commercal trade actvtes. The loophole types that result n the massve customer nformaton leakage account for about 4% of the total. The frst thng for Jngdong Mall to do to prevent customer nformaton from beng stolen s to fnd the loopholes of webste n tme and fx them mmedately once they are found, so that the attacker would have no chance to steal the customer nformaton. Today, personal nformaton prvacy s hghly concerned by the publc. Improvng the securty envronment of customer nformaton wll brng a better development for the e-commerce webstes on B2C platform. 284 Copyrght c 2014 SERSC

3 Internatonal Journal of Securty and Its Applcatons 4. Applcaton of Computng Model of E-Commerce Cloud Network Securty The scale expanson of e-commerce webstes has brought about a seres of nformaton securty problems. The server of e-commerce webste wll lose the hgh effcency data processng functon when facng massve data nformaton, and encounter a varety of obstacles n the deployment of nformaton resources. Although domestc e-commerce has been dvded nto multple patterns, nformaton leakage s stll the largest drawback durng the popularzaton perod of B2C webstes. Retalers do not take suffcent countermeasures to protect customer nformaton, whch leads to the personal prvacy of customers beng stolen and lowers the nformaton securty of the customers [9, 10]. The network plan computng model utlzes the overlappng network relatonshp to provde a broader platform for cloud data processng, so that the operaton rsks of e-commerce network can be reduced Basc Model of Overlappng Relatonshp Faced wth a more open network market, the data securty ssue of e-commerce has attracted wde attenton. Crss of confdence s the outcome of these massve customer nformaton leakage ncdents. An automated processng can be mplemented on busness data based on network overlappng relatonshp, and provde a plenty of references for data resources deployment. If the overlappng network s chosen to solve the cloud data securty ssue, the specfc crcumstances of overlappng relatonshp must be frst clarfed. In ths study, there are four basc overlappng relatonshps encountered by the sequence par (, ) wth partally or completely contnuous relatonshp Relaton from Fnsh to Start (FTS): There s the relatonshp requred of tme dstance from the fnsh of sequence to the start of sequence Relaton from Start to Start (STS): There s the relatonshp requred of tme dstance from the start of sequence to the start of sequence Relaton from Fnsh to Fnsh (FTF): There s the relatonshp requred of tme dstance from the fnsh of sequence to the fnsh of sequence Relaton from Start to Fnsh (STF): It s the relatonshp requred of tme dstance + from the start of sequence to the fnsh of sequence, that s, t s requred to complete after a tme of from the start of sequence, then after a tme of for performng sequence. The four types of relatonshp are shown as Table 1, and the combnatons of them form more complcated overlappng relatonshps. The overlappng relatonshps could be appled to more complex types of processng operatons on cloud data. The e-commerce enterprses should choose the data to process n accordance wth the actual stuaton, thereby ensurng the relablty of e-commerce cloud data. Copyrght c 2014 SERSC 285

4 Internatonal Journal of Securty and Its Applcatons Overlappng relatonshp type Overlappng relatonshp dagram Fnsh to Start 0 0 (FTS) T>0 Start to Start (STS) 0 0 Fnsh to Fnsh (FTF) 0 0 Start to Fnsh (STF) Delay Tme Dstance Fgure 1. Overlappng Network Relatonshp The network model of the basc overlappng relatonshp s used, and the cloud data processng flow s relatvely complex. There are two stuatons n the overlappng model of e-commerce cloud data processng: the frst one s that the sequence begns after sequence fnshes; the second one s that sequence can start before sequence fnshes. Therefore, the tme dfference from the end of sequence to the start of sequence can be utlzed to unfy varous overlappng relatonshps. The frst step s to execute the overlappng. The tme delay dstance of overlappng sequence par (, ) s the tme dstance from the start of sequence to the fnsh of sequence, whch s constraned by the overlappng relatonshp. It s denoted as T (, ). Accordng to the defnton, the calculaton equaton for tme delay dstance s: L T ( F T S ) L T t ( ) ( S T S ) (, ) L T t ( ) ( F T F ) L T L T t ( ) t ( ) ( S T F ) (1) 4.3. Relaton between Three Network Plans In order to get rd of the nformaton leakage rsks exstng n tradtonal e-commerce 286 Copyrght c 2014 SERSC

5 Internatonal Journal of Securty and Its Applcatons network, the cloud data processng can be based on overlappng network plan and the flow network plan s used as the computng model to help solve a seres of securty problems n the cloud data processng system. As shown n Fgure 1, n overlappng network plan, when (, ) 0, sequence and sequence does not overlap. When T (, ) 0, the two sequences begn to overlap. At ths tme, T (, ) s the tme dstance by whch sequence can start before fnshng sequence. The overlappng network plan s the network plan when there exsts the sequence par (, ) for (, ) 0. When (, ) 0, t means that sequence s mmedately after sequence n general stuaton. It s called general sequence par n the followng. The network plan s a general network plan when there s (, ) 0 for all sequence pars (, ). The flow network plan can be seen as an overlappng network plan wth STS overlappng relatonshp between flow processes. The flow step dstance s the overlappng tme dstance, and the correspondng delay tme dstance T (, ) s usually less than 0. Usng the network overlappng relatonshp, the processng flow of e-commerce cloud data can be smplfed. The overlappng network s used as the control center to execute data processng operatons, thereby guaranteeng the safe use of e-commerce network data. 5. Securty Control Platform Based on Framework Manager For the data processng on e-commerce cloud data, both general network plan and flow network plan are specal overlappng network plans, whle the overlappng network plan and flow network plan are the extenson of general network plan. B2C customer nformaton leakage can cause a varety of abnormaltes, and ncrease the rsk of e-commerce webstes, whch s apparently not conducve to the sustanable development of the new ndustry. Cloud computng s the mprovement of nternet-related servce. It can provde more network servces accordng to user requrements and to specfc tme. It focuses on treatng the servce ssues related wth the control of vrtualzed resource Modelng Cloud Data Securty As an mportant reportng tool n the ndustry, Cognos for cloud data securty modelng s also used n the securty processng of e-commerce cloud data, thus enhancng the relablty of B2C data. In the process of creatng data model wth Cognos Framework Manager [11], by ntroducng dfferent user groups or roles, dfferent data securty access levels are set for the same query obect. Therefore, dfferent user groups are allowed to access dfferent data subsets of the same query obect. Framework Manager s a clent-based modelng tool of Cognos, as shown n Fgure 2. The model s a set of related obects assocated wth each other, and can confgure the reportng form for e-commerce data and reflect the authentcty of data nformaton obectvely. Copyrght c 2014 SERSC 287

6 Internatonal Journal of Securty and Its Applcatons Data Source FM Desgn/Create Proect Prepare Metadata Prepare Busness Vew Publsh Set Securty Create &Manage Package Cognos Content Store Query Studo Report Studo Fgure 2. Framework Manager Workflow In Framework Manager, securty control s a method to control the access to Cognos product data and metadata. If t s set to be safe n FM, then access by selected users, user groups or roles to the content s controlled. The securty control n FM can be dvded nto three types Data Securty: It s used to constran the returned data, whch s used n specfc query obect. When the report developer s developng the report based on the query obect, whch data s returned to the customer s controlled Obect Securty: Accordng to the settng, the users have access to one obect, or do not have access to an obect, or one obect s hdden from some users. The obect here refers to the query obect, query term or flter crtera Packet Securty: The packet securty n FM means that whoever has the authorty to use the packet n Cognos Studo (QueryStudo, ReportStudo etc.) or whether there s the authorty to operate a report usng the packet n Cognos Connecton Cloud Technology Applcaton In the customer nformaton leakage ncdent of Jngdong Mall, although the customer nformaton s not stolen drectly from the target webste, t may be ndrectly accessed by concdence due to the connectvty of nternet. The automatc detecton of program code stored n cloud database can be used to actvely gve an alarm when dscoverng abnormal data to remnd the users to re-examne the data to perform a 288 Copyrght c 2014 SERSC

7 Internatonal Journal of Securty and Its Applcatons second transfer command. Hybrd cloud s a comprehensve type of e-commerce. The technque has a hgher operatng effcency n cloud computng processng and can execute data securty processng, whch helps the users detect the securty factor of the collected data. These are key ssues of consderaton when creatng modern e-commerce. 6. Conclusons In ths study, the obectve s to study the customer nformaton securty of e-commerce webste based on B2C platform. By analyzng the countermeasures for protectng the customer nformaton of the exstng e-commerce webstes based on B2C platform, the possble rsks of actual applcaton are ponted out. The work provdes a relable gudance for ensurng customer nformaton securty and for completng the management system of customer nformaton n e-commerce webstes based on B2C platform. Usng SPI nterface technology n e-commerce cloud data processng can buld dversfed cloud data processng model for users, and satsfy all requrements of deployments and utlzaton of e-commerce data resources. Acknowledgements Ths study has been fnancally supported by Humantes and Socal Scence Youth Fund Proect of Mnstry of Educaton (No.13YJCZH028). References [1] R. B. L, J. Y. Lu, S. Yuan and Y. L. Du, Study on Applcaton Software Update of the Mcro-Navgaton Computer by Seral Port, Mn-mcro Systems, vol. 12, no. 10, (2010), pp [2] N. He, W. M. F. Yun, C. P. Lu and J. Pe, Research on Sensor Technology Face to Wreless Sensor Network, Computer Applcatons and Software, vol. 19, no. 10, (2011), pp [3] P. L, L. K. Zeng, A. Z. Shu, X. L. Jn, Y. C. Lu and H. Wang, Desgn of Forecast System of Back Propagaton Neural Network Based on Matlab, Computer Applcatons and Software, vol. 17, no. 6, (2010), pp [4] B. L. Sh and W. Wang, The Survey of the Research on Data Warehouse and Data Mnng, Computer Applcatons and Software, vol. 15, no. 11, (2009), pp [5] J. H. Chen, Network Securty Data Transfer Method Research Based on Cloud Computng, Computer Smulaton, vol. 29, no. 8, (2012), pp [6] Z. B. Gan, C. Zeng, K. L and J. J. Han, Constructon and Optmzaton of Trust Network n E-Commerce Envronment, Chnese Journal of Computers, vol. 35, no. 1, (2012), pp [7] L. Xu, Y. Y. Zhang, J. Wu and B. Y. Fang, Network technology research under cloud computng envronment, Journal on Communcatons, vol. 33, no. 1, (2012), pp [8] M. M. Fu, Applcaton of Fuzzy Comprehensve Analyss to Informaton Securty Evaluaton, Journal of Southwest Jaotong Unversty, vol. 45, no. 3, (2010), pp [9] D. P. Zhang, K. Ca, M. Zhang and Z. Xu, The Research of Cloud Computng Data Securty Support Platform Archtecture, Journal of Computer Research and Development, vol. 48, no. S3, (2011), pp [10] C. F. Yang, G. Wang and J. H. S, Buld New Generaton EAI Based on SOA, Computer Applcatons and Software, vol. 22, no. 10, (2005), pp [11] IBM Cognos&Busness Intellgence, (2010). Copyrght c 2014 SERSC 289

8 Internatonal Journal of Securty and Its Applcatons Authors We Da, he receved hs M.S.E. n Computer Scence and Technology (2006) and PhD n Computer Applcaton Technology (2012) from Wuhan Unversty of Technology. Now he s full researcher of nformatcs at Economcs and Management Department, Hube Polytechnc Unversty. Hs current research nterests nclude dfferent aspects of Intellgence Computng and Informaton Systems. Xuefang Zhang, she receved her B.B.M. n Fnance (2004) and M.Ec n Industral Economcs (2007) from Huazhong Agrcultural Unversty. Now she s full researcher of nformatcs at Economcs and Management Department, Hube Polytechnc Unversty. Her current research nterests nclude dfferent aspects of Fnancal Engneerng and Informaton Computng. Peng Hu, he receved hs B.S. n Mathematcs (2003) from Hube Normal Unversty and M.Sc. n Informaton Scences (2010) from Hube Unversty. Now he s full researcher of nformatcs at Mathematcs and Physcs Department, Hube Polytechnc Unversty. Hs current research nterests nclude dfferent aspects of Artfcal Intellgence and Informaton Codng. 290 Copyrght c 2014 SERSC