© Donald F. Ferguson, 2014. All rights reserved. Topics in Modern Internet Application Development: Lecture 7: Review, Project Discussion and Directions,

© Donald F. Ferguson, 2014. All rights reserved. Topics in Modern Internet Application Development: Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Dr. Donald F. Ferguson Donald.Ferguson@software.dell.com

3 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Contents Review and discussion –Security and Zero Knowledge Proofs –Reference Material –Project Work Items New topics –An example of session management –An additional concept in commerce applications  content management –Introduction to and applications of four new database models –Redis –Amazon S3 –Amazon Simple DB –Amazon Dynamo DB

6 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Zero Knowledge Proof Some concepts –“In cryptography, a zero-knowledge proof or zero-knowledge protocol is a method by which one party (the prover) can prove to another party (the verifier) that a given statement is true, without conveying any information apart from the fact that the statement is indeed true.” –“If proving the statement requires knowledge of some secret information on the part of the prover, the definition implies that the verifier will not be able to prove the statement in turn to anyone else, since the verifier does not possess the secret information.” Typical authentication is not zero knowledge –Alice tells Bob her password. Bob knows Alice’s password andcould prove to someone else he is Alice. –A 3 rd party gains partial knowledge of the {UID, PW} even if the communication is encrypted. Alice Bob

7 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Partial Knowledge – My Perspective Alice is communicating with Bob sending messages –M[i] is Alice’s i-th message. –A[i] is the algorithm Alice uses to encrypt M[i]. –K[i] is the key Alice uses when applying A[i]. –E[i] is the encrypted, transmitted message applying A[i] using K[i] to M[i]. Some observations –You must always assume that Eve knows A[i], or “The Germans should have assumed we found an Enigma Machine.” –The likelihood that Eve can read your traffic increases with the number of messages you encrypt with a given K[i], or “Don’t use a one time one time pad more than once.” –The likelihood that Eve can decrypt E[i] increases with the number of times you send the same original message (M[i] = M[k] = … = M[p]), even if encrypted with different keys, or “The Enigma operator’s 1 st message of the day should not be ‘My key settings for today are …” Alice sending a user ID/PW, even if encrypted, is –Proving that she knows the password –But is also revealing information about what the password is.”

8 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Let ’ s Assume Bob Knowing the PW is OK Eve wants to uncover Alice’s {UID, PW} –S[U] = {set of possible user IDs} –S[P] = {set of possible PW strings} –O = {u, p} = S[U] x S[P] is the set of possible {UID, PW} –There are #(S[U]) * #(S[P]) = N = #(O) possibilities, and all Eve knows is that one is the {UID, PW}. Assume Eve guesses {“Alice”, “Canary”} and is wrong –Bob responds, “Invalid UID/PW.” –Eve now knows something about the correct {UID, PW} by being able to eliminate one element of O. So what? Bob will lock the account after 5 incorrect tries. But remember, –Eve may not care that she uncovers Alice’s {UID, PW}. –Eve may not care that she fools Bob. –All Eve cares about that is that she can guess a correct {UID, PW} for any user at any site with an account that has money. People tend to reuse PWs. Bob rejecting {“Alice”, “Canary”} indicates that Eve should not try the combination elsewhere.  Dictionary attacks become easier if sites reveal any UID/PW knowledge Alice Bob

9 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs I said, “ Encryption and Trust ” are the foundations of security. What about a Zero Knowledge Proof? The classic example is –Peggy wants to prove she knows the password to a door –Without revealing the PW to victor. Using a protocol and repeated experiments, Peggy can provide knowledge –Peggy can “guess right” 50% of the time. –The probability of Peggy proving she knows the password is [1 – (1/2)^N] after N –trials. But note –There is a shared secret between Peggy and the door. –There is implicit encryption to make sure no one hears Peggy. –There is trust, i.e. Bob trusts the door.

10 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Zero Knowledge Proof User authenticates to a trusted piece of local code, the browser. The browser produces –A session specific private key. –A one time random challenge graph. For simplicity, think a random polynomial, e.g. P(x) = X^3 – 7X + 3. –Signs the {UID, P(X)} with Alice’s private key –Encrypts the {UID, P(X)} with Bob’s public key. If Bob wants to authenticate Alice, Bob can repeatedly –Generate a random X –Ask Alice for the value of P(X) This approach never reveals information about a PW, even if the PW is a shared secret. Alic e Bob

11 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Summary Zero Knowledge Proofs –Are a very interesting technology and can solve several problems. –Were very controversial when I was in graduate school. Freaked out intelligence and security agencies but potentially providing an approach to security that was hard to crack. –But, are note widely used in practice Observations –Still require trust, encryption and shared secrets –Have drawbacks associated with widespread use of PKI. Everyone needs a verified certificate. –Simpler solutions exist to strengthen security –Password rules –Context, e.g. “Has done ever connected from this IP address before?” –Multi-factor authentication, e.g. “I am going to send you a code via SMS.”

13 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Reference Material There is no text book for this class –Many books on concepts are language/runtime specific, and I did not want to mandate a “language.” –We are covering a broad set of concepts. Most books are narrower, which means there would be many books. –The “cool” technology evolves faster than we can author and publish books. –Everything I could teach or you need to know “is on the web.” A couple of students asked for books describing concepts independent of language/runtime. –The classics are –“Patterns of Enterprise Application Architecture” by Martin Fowler –“Enterprise Integration Patterns: Designing, Building, and Deploying Messaging Solutions” by Holpe and Wolf. –I checked with colleagues that are active in commercial web application development. The concepts are still relevant. You will see that I use versions of the patterns in my lectures. – The best programmer I have ever known, and someone who mentors new programmers, recommended “Domain-driven Design: Tackling Complexity in the Heart of Software” by Eric Evans. I have not read this book.

14 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs An Interlude on Composite applications Polyglot programming Polyglot database Data flow and control flow programming Messaging Domain Specific Languages and impedance mismatch.

15 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs RabbitMQ https://www.rabbitmq.com/getstarted.html

17 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Application Structure Web Application Customer Controller Agent Controller V V Data Access Service CustomerDS AgentDS ContactDS Business Service CRM Services Customer Facade Agent Facade V V V HTML

18 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs We are going to build a composite app Evolve the simple CRM service –Implementation using new functions, e.g. notification, workflow, rules/policy, new database types, reports, … –“Portal” for on the glass integration of multiple sites. Use a SaaS, web callable product, price, billing, … API Build a very simple, multi-tenant web commerce application (catalog, cart, …) CRM Service Multi-Tenant Commerce Service SaaS Account/ Billing API Cloud Infrastructure APIs S3 SQS OpenID …

19 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Current Assignment Data Access Service CustomerDS AgentDS ContactDS Business Service CRM Services Customer Facade Agent Facade V V V Q UI Controller REST API Web UI Controller may be on server or in browser (e.g. Angular) Standalone App Amazon SQS SQS Adaptor

20 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Current Assignment I – REST API Define and implement a REST API for the simple CRM service Your REST API/implementation must support –Duplicate request detection and discard. –Pagination, e.g. ability to iterate through large result sets. –Support requests that go “asynch” and require polling for the result. –Simple query, e.g. finding customers by last name and zipcode. Demonstrate invoking your API –From Web pages –A “standalone” program calling the REST API –Via an Amazon SQS queue. Implement the following three “rules” in your application objects 1.Agents in the USA, except those in TX and NY can have at most 5 customers. 2.A customer can only update their contact information once/week, unless their agent is in MN or CT. 3.Assigning a new agent to a customer is only allowed if there are no “contact records” less than 72 hours old.

21 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Current Assignment – II Think about the commerce application –There are going to be many, many message exchanges –Browse –Add to cart –Remove from cart –etc. The commerce application needs to remember –What has gone into the cart during this commerce session –What I have searched for during this commerce session –Don’t ask me, “Are you interested in metric wrenches?” –When I am shopping for textbooks. –Just because I looked for screwdrivers three years ago. Technically, –I could have the client store and provide all session information on every request –But, … this is fragile and complicated So, the application –Generates a session key/ID –The client requests always contain the session key either in a cookie or URL (URL rewrite) –Maintains session state in a “database.” –Invalidates the session key/ID when the client logs out or the session times out.

22 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Current Assignment – II Build a simple commerce application –Product –Catalog –Customer –Shopping Cart Customers connect to the commerce application –Creating a commerce session –Search the catalog and view product information –Add items to the cart –Submit the cart You must figure out how to –Implement session behavior, e.g. “find the cart.” –Record what items a customer has viewed during the current session.

23 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Current Assignment III Data Access Service CustomerDS AgentDS ContactDS Business Service CRM Services Customer Facade Agent Facade VVV REST API “RabbitMQ” Subscriptions Notification Service Install and configure RabbitMQ Write a simple application that enables agents to CRUD subscriptions, specifying –Topics –Notify method Listens for events on Rabbit MQ and uses AWS API to notify agent using SNS or SES Modify CRM app to automatically emit events for CUD of customer

26 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Session State Management References –Patterns of Enterprise Application Architecture, Chapter 17. –Chapter 4: Creating and Managing User Sessions, Sun Java System Application Server Standard and Enterprise Edition 7 2004Q2 Developer's Guide to Web Applications. (http://docs.oracle.com/cd/E19644-01/817-5451/dwsessn.html)http://docs.oracle.com/cd/E19644-01/817-5451/dwsessn.html –The Java EE 6 Tutorial, Chapter 20, Stateful Session Beans http://docs.oracle.com/javaee/5/tutorial/doc/bnbly.html#bnbma http://docs.oracle.com/javaee/5/tutorial/doc/bnbly.html#bnbma We will examine Stateful SessionBeans –Independent of the protocol, i.e. not intertwined with HTTP –Simple, clean demonstration of the concepts –I helped invent it, and you have to learn to use it even if no one uses it.

27 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Stateful SessionBeans Stateful session beans are appropriate if any of the following conditions are true. –The bean’s state represents the interaction between the bean and a specific client. –The commerce application has many active customers. –The cart and browsing history are specific to each customer. –The bean needs to hold information about the client across method invocations. –Is there are cart? What is in the cart? –What has the customer viewed? –The bean mediates between the client and the other components of the application, presenting a simplified view to the client. –Behind the scenes, the bean manages the work flow of several enterprise beans. –Multiple components: catalog, cart, customer information, … –REST calls read and manipulate multiple entitities

32 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Hmmm This seems OK for “stateful” programming –Local Java programming where I can have references to instances –RMI/IIOP –etc. How does this work for REST/URLs? –One URL, e.g. …/cart/addBook?title=“Blah Blah” –Kind of references lots of things –Depending on the client making the call. Use a Façade –Another, user independent, singleton implements interface cart –Extracts customerID for the HTTP header –Looks up the cart in a Map and delegates to the real cart –If the “real cart” does not exist, it create a cart and puts in the map. Do not do you assignment this way –This tutorial is awful. “Cart” is an EntityBean, not a SessionBean. –A REST/HTTP Session would typically have state independent of Stateful SessionBeans. –I used this example to help draw the distinction between pattern and realization.

35 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Query Results {author, “Ferguson”} {includes, {paper, {author, “Ferguson”}}} {references, {book, {author, “Ferguson”}}}

36 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Data and Rendering Two different renderings Of the same underlying document

37 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Content Management System Some Terminology A content management system (CMS) is a computer application that –Allows publishing, editing and modifying content, organizing, deleting as well as maintenance from a central interface. –Such systems of content management provide procedures to manage workflow in a collaborative environment. A web content management system is a bundled or stand-alone application –To create, deploy, manage and store content on Web pages. –Content includes text and embedded graphics, photos, video, audio, … –Content includes code that displays content in a specific way –A Web CMS may catalog and index content, select or assemble content at runtime, or deliver content to specific visitors in a requested way, such as other languages.

39 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Why Don ’ t I Just Use … A relational database? RDBs do not handle –Dynamic taxonomies/folders particularly well. –Relatively free form tagging and query of items. –You can realize the model in relational, but you have to write a specific schema. –Your code is awkward and you write “framework,” which is a CMS. A file system? –File systems do not handle arbitrary metadata well. I want to find documents with author=“Ferguson” not containing the text “Ferguson.” –I want to publish or rollback all changes made by Bob in the last 24 hours. –Jim must approve all contributions of type “Press Release.” MongoDB? –Handle hierarchical and dynamic tags well. –Not great for images, audio, … –Would still need some framework code.

41 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs The Simple Commerce Application Needs a CMS Product classification, e.g. –Classification I: Books, Magazines, Videos –Classification II: Sports, Engineering, Business Relatively freeform, queryable information –Artist Type = {Author, Editor, Contributor, Reviewer, …}.Name={…} –Format = {eBook, paperback, audiobook, …} Fragments of a rendering, e.g. –Images –Reviews –Descriptive prose –TOC Various renderings, e.g. –Summary in a search result –Full information

42 © Donald F. Ferguson, 2014. All rights reserved.Modern Internet App Development – Lecture 7: Review, Project Discussion and Directions, Sessions, SaaS, new DBs Commerce Application We are not going to use a full functional CMS –Powerful, but complex to set up and use. –Hides some interesting concepts. –Conflates orthogonal concepts. We are going to use –Redis for tracking what users have viewed, usage frequency, etc. –S3 for storing “content” and associated metadata –Images,.WAV files, etc. –Created date, author, tags, … –SimpleDB for product descriptions, categories, …

© Donald F. Ferguson, 2014. All rights reserved. Topics in Modern Internet Application Development: Lecture 7: Review, Project Discussion and Directions,

Similar presentations

Presentation on theme: "© Donald F. Ferguson, 2014. All rights reserved. Topics in Modern Internet Application Development: Lecture 7: Review, Project Discussion and Directions,"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

© Donald F. Ferguson, 2014. All rights reserved. Topics in Modern Internet Application Development: Lecture 7: Review, Project Discussion and Directions,

Similar presentations

Presentation on theme: "© Donald F. Ferguson, 2014. All rights reserved. Topics in Modern Internet Application Development: Lecture 7: Review, Project Discussion and Directions,"— Presentation transcript:

Similar presentations

About project

Feedback