Repository navigation
System Features
The client had come to us with three major requirements: i) Privacy, ii) Trust and iii) Consent. This messaging service aims to satisfy all the above and their implementation is described below.
Privacy - All messaging is done by sending directly to the recipient’s web-app. Broadcasts are sent encrypted to all users online at that current point of time. Private messages are however encrypted and sent to the targeted user (if they are online). In the event of the receiver being offline at the instant the message is sent, the private message is now sent to all online users available. Since the message is encrypted, none of these users will be able to decrypt the data but will store it some sort of database. When the intended recipient comes back online, they automatically send a request to all online users available asking for any messages meant for them. Once the intended recipient gets their message, they can now decrypt it (all done automatically) and view the message in the chat history. All this is automatic and allows for smooth transitioning of both broadcasts and private messages.
Trust – The messaging service has multiple ways to test if the information we are getting is genuine or not. Initially, all users joining the server must authenticate themselves against the central server. Once that is achieved, only then can the user message or send broadcasts out to to others. Secondly, all broadcasts and messages have an associated signature attached to them. Since this signature is a pre-defined combination based on the sender info, the recipient has the ability to verify this. If any of the information doesn’t match the expected response, we can detect for any bugs (or even hackers) in the system.
Consent – The web-app allows for the user to block any user they don’t wish to receive broadcasts from. Additionally, explicit words have been filtered to maintain decency for the user. This is highly beneficial since the client wants their daughter to use the messaging service too.
A few extra features such as Timing other users out who aren’t responding quick enough, use of sessions and API-keys for access to a session and storing Private data on the Login server are some ways my web-app increases security and user interface. These help improve the system functionality immensely. The UI is also maintained a high level, and allows for ease of use. JQuery (especially Ajax), HTML and CSS have been used to achieve this. Sign In allows for authentication with the Login Server and allows extraction of Private Data stored on the Login Server. API-key is also generated and a session is set up. The session expires on Sign Out of the web-app. Group Invites can be sent but no messages can be decrypted in group messages yet.
https://github.com/uoa-cs302/2019-Python-ddhy609/wiki/System-Implementation-and-Architecture