Loading...
Publication
Gestao de Acesso a Dados no Back-End: Controlo de Acesso Baseado em Funções e Geração Automática de Relatórios
| Name: | Description: | Size: | Format: | |
|---|---|---|---|---|
| 387.08 KB | Adobe PDF |
Advisor(s)
Abstract(s)
Atualmente, e guardada uma quantidade significativa de informação em aplicações disponibilizadas online, pelo que se tornou imperativo proteger os dados com um elevado grau de confiança, para que não possam ser furtados ou acedidos por entidades que não tenham autorizações para tal. Esta dimensão de segurança e a principal vertente do presente projeto, realizado no âmbito do mestrado em Engenharia Informática, que consiste no desenho e criação de vários serviços para um software de certificação ambiental, designado por FSIM. Dos desenvolvimentos realizados para o efeito, descritos ao longo deste trabalho, realçam-se dois: um sistema de controlo de acessos e um servidor de relatórios. O sistema de controlo de acessos, baseado em funções, permite intermediar a gestão de permissões dos utilizadores. Apesar de ser aplicado ao FSIM, este modelo pode ser empregue em inúmeras outras aplicações Java Spring. O servidor de relatórios Jasper possibilita à geração automática de relatórios, atendendo a regularidade e a necessidade de utilização de um serviço desta natureza por parte de empresas em auditorias. Este servidor impôs-se para substituir o Jasper Server, devido aos constrangimentos deste relativos ao controlo de versões do método de integração contínua adotado pela equipa. Neste trabalho, são igualmente expostas as diferentes abordagens de gestão de utilizadores dentro de uma aplicação, entre as quais se destaca a atribuição de perfis aos utilizadores com determinadas funções, associadas a realização de ações específicas. Para uma correta integração contínua, foram desenvolvidos testes unitários, que permitem garantir as funcionalidades implementadas no ciclo de vida do software. Com base nos devidos requisitos de segurança, a robustez e a fiabilidade foram dos principais aspetos a ter em conta, pelo que se realizaram e analisaram ainda vários testes de penetração.
Nowadays, a significant amount of information is stored in applications available online, thus it has become imperative to secure data with a high degree of reliability, so that it cannot be stolen or accessed by entities without proper authorization. This dimension of security is the main focus of this project, set forth within the scope of the master’s degree in Informatics Engineering, which consists of the design and deploy ment of several services for a software of environmental certification, called FSIM. In this document, we present the developments for this software in detail, from which we highlight two: an access control system and a report server. The access control system, developed over a role-based model of access control, allows intermediation of user per missions management. Despite being applied to FSIM, this model can be used in other Java Spring applications. The Jasper report server enables the automatic generation of reports, meeting the regularity and the need of companies to use a service of this nature in audits. The Jasper Server needed to be replaced by this server, due to its constraints related to version control of the continuous integration method adopted by the team. The different user management approaches within an application are also studied in this work, among which the attribution of profiles to users with certain roles in order to execute specific actions stands out. Furthermore, for a correct continuous integration, unit tests were developed, aimed to guarantee the functionalities implemented in the software’s life cycle. Based on the appropriate safety requirements, robustness and dependability were among the main aspects to be taken into account. Hence, several penetration tests were also performed and analysed.
Nowadays, a significant amount of information is stored in applications available online, thus it has become imperative to secure data with a high degree of reliability, so that it cannot be stolen or accessed by entities without proper authorization. This dimension of security is the main focus of this project, set forth within the scope of the master’s degree in Informatics Engineering, which consists of the design and deploy ment of several services for a software of environmental certification, called FSIM. In this document, we present the developments for this software in detail, from which we highlight two: an access control system and a report server. The access control system, developed over a role-based model of access control, allows intermediation of user per missions management. Despite being applied to FSIM, this model can be used in other Java Spring applications. The Jasper report server enables the automatic generation of reports, meeting the regularity and the need of companies to use a service of this nature in audits. The Jasper Server needed to be replaced by this server, due to its constraints related to version control of the continuous integration method adopted by the team. The different user management approaches within an application are also studied in this work, among which the attribution of profiles to users with certain roles in order to execute specific actions stands out. Furthermore, for a correct continuous integration, unit tests were developed, aimed to guarantee the functionalities implemented in the software’s life cycle. Based on the appropriate safety requirements, robustness and dependability were among the main aspects to be taken into account. Hence, several penetration tests were also performed and analysed.
Description
Trabalho de projeto de mestrado, Engenharia Informática (Engenharia de Software) Universidade de Lisboa, Faculdade de Ciências, 2020
Keywords
Controlo de Acesso Baseado em Funções Testes de Penetração Spring Jasper Gestão de Utilizadores Trabalhos de projeto de mestrado - 2020