Skip to content

Authentication-Authorization.md

Latest commit

 

History

History
100 lines (82 loc) · 3.85 KB

Authentication-Authorization.md

File metadata and controls

100 lines (82 loc) · 3.85 KB
Raw

Industrial Evidence Chain — Authentication & Authorization Architecture

1. Security Overview

The Industrial Evidence Chain enforces a multi-layered security architecture conforming to the Principle of Least Privilege (PoLP) and zero-trust verification. All protected endpoints mandate cryptographically signed JSON Web Tokens (JWT) and evaluate granular Role-Based Access Control (RBAC) claims before executing business logic.

2. JWT Token Architecture

Authentication is stateless, utilizing HMAC-SHA256 (HS256) signed tokens generated upon successful verification of BCrypt password hashes.

2.1 Token Claims Payload Structure

{
  "sub": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "email": "tech@proofchain.local",
  "name": "Alex Rivera",
  "role": ["Technician"],
  "jti": "8b9195b0-3ef0-482a-9e12-8e137b0ff462",
  "iss": "Proofchain-AuthServer",
  "aud": "Proofchain-EnterpriseAPI",
  "exp": 1788523200,
  "nbf": 1788436800,
  "iat": 1788436800
}

2.2 Security Parameters

  • Signature Algorithm: HMAC-SHA256 (HS256)
  • Key Length: 256-bit symmetric secret key (configured via environment variable JWT__KEY or secure key vault)
  • Token Expiration: 24 hours (86,400 seconds)
  • Clock Skew Tolerance: Zero seconds

3. Role-Based Access Control (RBAC) Matrix

The system classifies organizational actors into four primary functional roles:

API Action / Resource Technician Manager Auditor Admin
Authenticate / Login Yes Yes Yes Yes
View Dashboard Statistics Yes Yes Yes Yes
Scan / Search Assets Yes Yes Yes Yes
Register New Asset No Yes No Yes
Update Asset Details No Yes No Yes
Create Draft Evidence Yes No No Yes
Upload Media Attachments Yes No No Yes
Submit Evidence for Review Yes Yes No Yes
Anchor Evidence to Ledger No Yes No Yes
Verify Evidence Integrity Yes Yes Yes Yes
Inspect System Audit Logs No No Yes Yes
Execute Tamper Simulation (Demo) No No No Yes

4. ASP.NET Core Middleware Pipeline

Requests flow through the ASP.NET Core pipeline in the following sequence:

[Incoming HTTP Request]
          |
          v
[1. Global Exception Handler Middleware]
   -> Captures unhandled faults and returns standardized RFC-7807 problem details
          |
          v
[2. CORS Middleware]
   -> Allows preflight and cross-origin requests from authorized front-end origins
          |
          v
[3. Authentication Middleware (`UseAuthentication`)]
   -> Validates JWT signature, expiration, issuer, and audience
   -> Populates `ClaimsPrincipal` onto `HttpContext.User`
          |
          v
[4. Authorization Middleware (`UseAuthorization`)]
   -> Evaluates `[Authorize(Roles = "...")]` attributes on controllers and actions
   -> Rejects unauthorized requests immediately with `401 Unauthorized` or `403 Forbidden`
          |
          v
[5. Controller Action Execution]
   -> Business logic executes with authenticated user identity
          |
          v
[6. Audit Logging Interceptor]
   -> Captures mutating actions and writes immutable record to `audit_logs`

5. Front-End Session & Token Management

The React 19 client application secures tokens via:

  1. In-Memory & Storage Encapsulation: Stored in localStorage under token and user keys.
  2. Axios Request Interceptor: Automatically attaches Authorization: Bearer <token> to all outgoing API calls.
  3. Axios Response Interceptor: Intercepts 401 Unauthorized responses, clears local session storage, and redirects the user to the /login portal.
  4. Role Guards: Front-end route guards (ProtectedRoute.tsx) restrict unauthorized URL navigation and hide privileged UI elements based on the decoded token roles.