Exercise 16: Group Reflective Study

Choose one of the four ways to manage and develop integrated systems as listed in the study guide. Summarize your understanding and describe its relevance in either your study at university or in your work environment. 

I have chosen Business process analysis as my preferred method in managing and developing integrated systems.
As per my understanding, every business organization is basically utilizes a set of business processes to generate revenue and to govern their business operations. That being said, the role of a business process is crucial enough that affects the business significantly.In my field of work as an IT consultant, I have worked with many companies who has implemented and are using ERP systems, sometimes in conjunction with other systems such as CRM and S&OP in their companies to run their business. From what i have observed, each business has their own unique business processes & logic, and ERP systems are found to be most suitable in managing their data and processes for the time being.
The benefit of ERP is the ability to build a system for a company around the existing processes and current systems and integrate them ("Savvion," 2010). Employing a cloud provider also decreases overheads and staffing costs that may have to come with the integration of any new system into a company that are resistant to change and to the introduction of any new technology. Of course this is not always possible and the new system will need to be introduced ("Savvion," 2010).

Net MBA (2010). Process Analysis Retrieved 28th May 2010, from http://www.netmba.com/operations/process/analysis/

Savvion (2010). Business Process Analysis Retrieved 28th May 2010, from http://www.savvion.com/business_process_analysis

Exercise 15: M-Commerce: Innovation and Mobile Devices

1. What is meant by a location based service? Explain using the Web applications found on a late model mobile device.

A location-based service (LBS) is an information service, accessible with mobile devices through the mobile network and utilizing the ability to make use of the geographical position of the mobile device. An example of this is the Map/Navigation function or GoogleMaps found in many of today's mobile phones. GoogleMaps will retrieve information on the device's whereabouts and it's surroundings to provide users with a sense of direction by displaying the information on the device's screen as a map. The concept on determining the users position can be done by measuring the phone's distance from the cell-phone towers nearby or using GPS services provide an accurate location of the subject in relation to the services specified by the user. 

2. Describe the purpose of Open Mobile Alliance Initiative?

OMAI's main goal is to remove the barriers to global user adoption and to ensure seamless application interoperability while allowing businesses to compete through innovation and differentiation. This is done to grow the market of mobile industry to a new level of inter-operability.

Through OMAI, competition are encouraged through innovation and differentiation, while ensuring the interoperability of mobile service through the entire value chain.

3. What are the main components of a mobile Web services framework?According to The European Space Agency (2008), the components of a mobile web services framework are:

Mobile Server
The Mobile Server is a mobile remote computer, linked to the Internet via an Inmarsat Regional Broadband Global Area Network (RBGAN) User Terminal (UT).

Gatekeeper
The Gatekeeper is placed on the terrestrial Internet, and acts as the sole gateway to the Mobile Server.

RBGAN UT / Thuraya Satellite / RBGAN SAS
The physical connection between the remote web server and the Gatekeeper is established using a Satellite Access Station, a Telecommunications Satellite and a satellite modem.

GPS / Data Acquisition system / Web cam
The Mobile Server is connected to a set of peripherals, such as a GPS device, a web cam and/or a Data Acquisition system.

Application server / Client PC
The Gatekeeper handles requests from clients over the Internet.

4. Visit an airline Web site and search for information on WAP or SMS or 3G mobile application access to the booking airline system. The same services exist in banking. How do they compare?

Companies researched: 

Singapore Airlines and Commonwealth Bank

The difference in the services provided on the different business is that, on Banking systems, security is the priority, this can be seen clearly, when opening a connection to the site, which is done through a secure SSL connection. Upon exiting the site, secure information contained in the phone browser's cache are prompted to be removed as to its secure nature.  On the other hand, on airline web site, the only concern is having customers having to be able to connect to the system anywhere, so security measures are mainly only implemented on sensitive areas such as booking checkout.

References:

Location-Based Sevice.Wikimedia Foundation, Inc. From http://en.wikipedia.org/wiki/Location-based_service Retreived on 28/05/2010

Mobile Web Services Framework (2008).European Space Agency 2008, ESA Telecommunication. From
http://telecom.esa.int/telecom/www/object/index.cfm?fobjectid=12852 Retrieved on 28/05/2010  

http://www.singaporeair.com Retrieved on 28/05/2010 

http://www.commbank.com.au Retrieved on 28/05/2010 

http://en.wikipedia.org/wiki/Open_Mobile_Alliance Retrieved on 28/05/201

Exercise 14: Searching Mechanisms, virtual worlds and cyberagents

1.  What is a spider? What does it do?

A spider is a piece of software which  designed to go through or "crawl" through a specific medium.  These mediums could be as simple as a text file, a database table or as complex as  the internet. In the internet, web-crawlers /spiders are used in search for new websites/ pages.  A web-crawler visits crawls through the internet by visiting sites and links to and from the sites. on finding a new web page or website, the web-crawler indexed and cataloged their findings for future rapid retrieval. Search companies e.g. Google use spiders to keep being updated on these new sites and to find updates on the known sites to increase the accuracy of their search results

2. Differentiate the various types of software agents.

A software agent is a a software entity which functions continuously and autonomously
in a particular environment, often inhabited by other agents and processes (Shoham 1997). Software agents differ from conventional software in that they are long-lived, semi-autonomous, proactive, and adaptive.
These include:
Intelligent agents  are agents that in particular exhibits some aspect of Artificial Intelligence, such as learning and reasoning.
Autonomous agents  - agents that are able to adapt, giving them the ability to modify their approaches in achieving their objectives.
Distributed agents  - agents that are being executed on physically distinct computers over distribution network.
Multi-agent systems  - distributed agents that do not have the capabilities to achieve an objective alone and thus must communicate with other agents.
Mobile agents  - agents that can relocate their execution onto different processors, hence: mobile.

3. Identify various activities in e-commerce where software agents are currently in use.

Buyer agents or shopping bots  are used in many eCommerce shops, for example  Amazon.com .The sopping bot provides a list of books recommendations based on your buying history.

User or personal agents example at jobdb.com , which sends email notifications about the current available jobs in the market according to your personal resume data.

Monitoring and Surveillance agents are used in NASA's Jet Propulsion Laboratory,  which monitors inventory, planning and scheduling equipment ordering to keep monitoring and surveillance costs down.

Data Mining agents are commonly used in credit card companies to provide them with information on consumer's spending habits and tendencies. These information gathered by the miners could be priceless to the businesses in forecasting the market behavior.

References:

Shoham, Y. 1997. An Overview of Agent-oriented Programming. In Software Agents, ed
J. M. Bradshaw. Menlo Park, Calif.: AAAI Press.

http://en.wikipedia.org/wiki/Web_crawler accessed on 28/05/2010
 
http://en.wikipedia.org/wiki/Software_agent accessed on 28/05/2010

Exercise 13 : Shooping Cart Specifications

Develop the class diagram for the following shopping cart specifications:

A shoppingCart object is associated with only one creditCard and customer and to items in itemToBuy object. Persistent customer information such as name, billing address, delivery address, e-mail address and credit rating is stored in the customer object. The credit card object is associated with a frequentShopper discount object, if the credit rating for the customer is good. The customer can make or cancel orders as well as add and delete items to the shopping cart product. The credit card object contains the secure method for checking that the charge is authentic.

Class Diagram

Excercise 12 : Modelling with UML or VMC?

Examine the Use Case in Figure 4 and explain the MVC architecture of the online bookstore needed to Lookup Books and Add to Shopping Cart.

Figure 4: Use case diagram for a customer using a shopping cart at an online bookstore.

Lookup Books

Model: Online bookstore database, which contains all of the required information about the book as well as information on the current inventory status.

Views: Book search form, Book Search Result Page

Controllers: BookSearch() -  method containing algorithm that utilizes information entered on the form to search the database for hits and returns them if any.

 

Add to shopping Cart

Models: Customer & Orders Table in the database. Customers table will hold all of the relevant information about the customer, whereas the Orders will contain Information about the orders in relation with a particular customer.

Views: Shooping cart List

Controllers: CartManager() - method containing functions to add/edit remove entries to the shopping cart.

Exercise 11 : TP Monitors and Transaction Protocols

1. Give a description in your own words of the ACID properties of a transaction.
ACID transaction stands out for Atomic, Consistent, Isolated & Durable Transactions. This property guideline is very useful in Database Management Systems to ensure effective, efficient and reliable data management.
 

Atomicity

Atomicity requires that database modifications must follow an all or nothing rule. Each transaction is said to be atomic if when one part of the transaction fails, the entire transaction fails and database state is left unchanged.

An atomic transaction cannot be subdivided, and must be processed in its entirety or not at all. Atomicity means that users do not have to worry about the effect of incomplete transactions

 

Consistency

The consistency property ensures that the database remains in a consistent state; more precisely, it says that any transaction will take the database from one consistent state to another consistent state.

 

Isolation

Isolation refers to the requirement that other operations cannot access or see data that has been modified during a transaction that has not yet completed. Each transaction must remain unaware of other concurrently executing transactions, except that one transaction may be forced to wait for the completion of another transaction that has modified data that the waiting transaction requires.

 

Durability

Durability is the guarantee that once the user has been notified of a transaction's success, the transaction will not be lost. The transaction's data changes will survive system failure, and that all integrity constraints have been satisfied

References:
Gray, Jim (September 1981). "The Transaction Concept: Virtues and Limitations" . Proceedings of the 7th International Conference on Very Large Databases. 19333 Vallco Parkway, Cupertino CA 95014: Tandem Computers.

2. Describe a TP monitor environment. How can a TP monitor stop an operating system being overwhelmed?

TP Monitor stands for Transaction Processing monitor, which is a control program that manages the transfer of data between multiple local and remote terminals and the application programs that serve them. It may include programs that format the terminal screens and validate the data entered.

TP monitor helps distribute the processes across the application and database server and avoid the overwhelmed of the operating system. TP monitor acts as a load balancer which balances  the load of a system by balancing the load of assigned processes to another machine in a distributed client/server environment. A TP monitor also enhances the assurance that all database are updated from a single transaction.

References:
Puntti, Tanya. (2007). “Database Application Development”. TP Monitors in large database systems. Retrieved 26th May 2010 from : http://www.hypergurl.com/blog/databases/architecture-tp-monitor.html

Exercise 10 : Concurrency and Threading demonstration in Phyton

1. Find definitions for eight terms and concepts used in threaded programming:-

1. Thread Synchronisation
Mehta (2002) explained that Thread Synchronization refers to the act of shielding against multithreading issues such as data, races, deadlocks and starvation, in which the synchronization event classes allow one thread to notify the other threads of some event.

Daelin (n.d.) pointed out that thread synchronization requires a running thread gaining a “lock” on an object before it can access it. The thread need to work with another thread that is using the method/data member. Thread synchronization helps prevent or eliminate problem being happened when two threads try to change a variable or execute the same method at the same time.

Hence, each thread has its own local thread stack and registers. To avoid any object and data corruption when multiple threads try to read and acces the same data, thread synchronization with two stages apply. They are signaled and non-signaled. The signaled state allows objects to access and modify data, while the non-signaled state allows access and modify the data in thread local stack.


2. Locks
Oracle explained that Thread locks are a kind of spin that uses to lock a thread for purpose of changing thread state.

Locks are used for enforcement of concurrency control policies, while a lock is a synchronization mechanism for enforcing limits on access to a resource in an environment where existence of many threads of execution.

Locks require hardware support for implementation in some cases. For example, atomic instructions allow a single process to perform if the lock is free, then, acquire the lock in a single atomic operation if free. (Wikipedia, 2010a)


3. Deadlock
A deadlock is happened where two or more threads or actions are waiting each other to finish and release the resource, however, none of them does, no thread or action is able to execute, which is resulting in timeout eventually. This deadlock arises in a system with multiple active asynchronous processes. (Wikipedia, 2010b and Deadlock, n.d.)


4. Semaphores
Semaphore is a protected variable or abstract data type that constitutes a classic method of controlling access by several processes to a common or shared resource in a multiprogramming environment. It can be classified as binary and counting. A binary semaphore is a simple locked or unlocked flag that controls access to a single resource, while a counting semaphore is a counter for a set of variable resources. Both semaphore types can be used to prevent a race condition, but do not have value in preventing resource deadlock. (Wikipedia, 2010c)


5. Mutex (mutual exclusion)
Mutex known as Mutual exclusion, which is a program object that allows multiple program threads to share the same resource including file access, and avoid simultaneous use of a common resource. A mutex is created with a unique name when a program is started. Thread that needs the resource must lock the mutex from other threads while it is using the resource. The mutex is set to unlock when the data is no longer in use or the task is finished. (Webopedia, 2001)


6. Thread
A thread can be referred to executing concurrent operation. A thread of execution results from a fork of a computer program into two or more concurrent running tasks. The implementation of threads and processes differs from one operating system to another, but it is contained inside a process in most cases. Multiple threads can be existed within the same process and share resources like memory, while different processes do not share these resources. (Wikipedia, 2010d)


7. Event
Event-driven programming is a programming paradigm where the flow of program is determined by events such as sensor outputs or user actions, or instructions from other programs or threads. (Wikipedia, 2010e)

So (n.d.) illustrated that simple programs have clearly defined main flow that is sequential from beginning to the end within event-driven programming. A stream of events coming into a program, a dispatcher determines the handler to response for the even, while the event is sent to the handler for proper handling.


8. Waitable timer
Microsoft (2010) documented that a waitable timer object is a sunchronization object which state is defined to signaled when the specified due time arrives. Two types of waitable timers available, which can be created manual-reset and synchronization. Both can be defined as periodic timer basis


2. A simple demonstration of the threading module in Python (threaddemo.py) that uses both a lock and semaphore to control concurrency is by Ted Herman at the University of lowa. The code and sample output below are worth a look. Report your findings.

The program tries to control the maximum number of tasks to be run at a time interval. The maximum number of tasks being run is 3, while the others are locked and queued until the first one being completed.

According to the results, the first 3 tasks run in sequence and in parallel, while thread 4 to 9 are pending. When thread 0 completed, message displayed to show the finished status, and current tasks in progress reduced to 2, follow immediate message to display the concurrent tasks being increased to 3 again. These status were repeated once a thread is finished and another thread is append. The program ended until all thread is completed.


Reference:-

Deadlock. (n.d.). Retrieved 26 May 2010 from http://personal.cityu.edu.hk/~dcykcho/book/Chapter9.htm.

Daelin. (n.d.), What is Thread Synchronization?. In WikiAnswers. Retrieved 26 May 2010 from http://wiki.answers.com/Q/What_is_Thread_Synchronization.

Mehta, Manisha. (2002). Multithreading Part 3: Thread Synchronization. Retrieved 26
May 2010 from http://www.c-sharpcorner.com/UploadFile/mmehta/Multithreading311162005045743AM/Multithreading3.aspx.

Microsoft. (2010). Waitable Timer Objects. In Microsoft.com. Retrieved 26 May 2010 from http://msdn.microsoft.com/en-us/library/ms687012(VS.85).aspx.

Oracle. (n.d.). Thread Locks. In Oracle. Retrieved 26 May 2010 from http://docs.sun.com/app/docs/doc/817-6223/6mlkidlmf?a=view

So, H. (n.d.). Event-Drive Programming – Designing Graphical User Interface. Retrieved 26 May 2010 from http://www.eee.hku.hk/~hso/engg1002eee/handouts/4-gui.pdf.

Wikipedia. (2010a). Lock (computer science). In Wikipedia, the free encyclopedia. Retrieved 20 May 2010 from http://en.wikipedia.org/wiki/Lock_(computer_science).

Wikipedia. (2010b). Deadlock. In Wikipedia, the free encyclopedia. Rertieved 20 May 2010 from http://en.wikipedia.org/wiki/Deadlock.

Wikipedia. (2010c). Semaphore (programming). In Wikipedia, the free encyclopedia. Retrieved 20 May 2010 from http://en.wikipedia.org/wiki/Semaphore_(programming).

Wikipedia. (2010d). Thread (computer science). In Wikipedia, the free encyclopedia. Retrieved 20 May 2010 from http://en.wikipedia.org/wiki/Thread_(computer_science).

Wikipedia. (2010e). Event-driven programming. In Wikipedia, the free encyclopedia. Retrieved 20 May 2010 from http://en.wikipedia.org/wiki/Event-driven_programming.

Webopedia. (2001). Mutex. In Webopedia.com. Retrieved 20 May 2010 from http://www.webopedia.com/TERM/M/mutex.html.

Exercise 9 : Electronic Payments and Security I

Questions:

1.  Find out about SET and the use of RSA 128-bit encryption for e-commerce
2. What can you find out about network and host-based intrusion detection systems?
3. what is "phishing"?
4. What is SET and how does it compare to SSL as  platform for secure electronic transaction? is SET is the common use?
5. What are cookies and how they are used to improve security? Can the use of cookies be a security risk?
6. What makes a firewall a good security investment? Accessing the internet, find two or three firewall vendors. Do they provide hardware, software or both?
7. What measures should e-commerce provide to create trust among their potentioal customers? What measures can be verified by the customer?
8. Get the latest PGP information from http://en.wikipedia.org/wiki/Pretty_Good_Privacy. The use of digital certificates and passports are just two examples of many tools for validating legitimate users and avoiding consequences such as identity theft.

 Answers:

1. SET stands for Secure Electronic Transaction and is a standard developed to ensure secure credit card transactions. SET is endorsed and developed by Microsoft, Visa and MasterCard. SET is based on the use of digital signatures to verify the buyers identity, to minimize the risk of unauthorized transactions and to ensure the privacy of the buyer's credit card details during the transaction. SET protocol relies on two different encryption mechanism and authentication mechanism. SET uses 56 bits session keys which are transmitted asymmetrically and the remainder transaction uses symmetric encryption in the form of Data Encryption Standard (DES).
   
   RSA stands for the trio's name which first defined the algorithm :Rivest, Shamir and Adleman. RSA is an algorithm utilized for public-key cryptography. It is suitable for signing as well as encrypting messages. this flexibility makes it useful in many applications, making it widely used in e-commerce protocols. RSA is using a 128-bit encryption this means that it is utilizing 128 bit-long key to encrypt the data.  A longer key provides better protection against brute force attacks to crack open the encryption.
   
   References:
   
   Secure Electronic Transaction. Wikipedia. 2010.Wikimedia Foundation, Inc. Retreived on May 25, 2010 from http://en.wikipedia.org/wiki/Secure_Electronic_Transaction
   
   Secure Electronic Transaction: An Overview. Retrieved on May 25, 2010 fromhttp://www.davidreilly.com/topics/electronic_commerce/essays/secure_electronic_transactions.html
   
   RSA. Wikipedia. 2010.Wikimedia Foundation, Inc. Retreived on May 25, 2010 from http://en.wikipedia.org/wiki/RSA
   
   
   
2. Network Based Intrusion Detection System(IDS) is the system that reads and scans incoming packets from the network to the host computer to find suspicious patterns, signatures or rules that indicates an Intrusion is taking place from the network. IDS attack recognition module uses four techniques in recognizing signatures:
   1. pattern, expression or byte code matching
   2. Frequency or threshold crossing
   3. Correlation of lesser events
   4. Statistical anomaly detection.
   If an attack has been detected, IDS will continue with the specified actions such as showing a notification to the administrator, connection termination or session logs and records.
   
   A Host-Based Intrusion Detection System monitors threats  that present in the host computer. It detects and scans resources that are used by  running programs to identify any possible threat that is present in the computer. Host-Based IDS uses an object database of the system objects which it should monitor. To improve its accuracy, Host Based IDS commonly keeps track of all the events that have occur. Host Based IDS is superior in detecting threats and risks compared to a Network-Based IDS as it could thoroughly check the running programs and compare it with its object database, and being host-based, it does not require additional hardware to be implemented. However on Host-Based IDS, intrusion detection takes longer compared to the Network-Based IDS.
   
   Reference:
   Network Intrusion Detection System. Wikipedia. 2010.Wikimedia Foundation, Inc. Retreived on May 3, 2010 from http://en.wikipedia.org/wiki/Network_intrusion_detection_system
   
   Network vs Host-Based Intrusion Detection. Retrieved on May 3, 2010 from http://documents.iss.net/whitepapers/nvh_ids.pdf
   
   Host-Based Intrusion Detection System. Wikipedia. 2010.Wikimedia Foundation, Inc. Retreived on May 3, 2010 from http://en.wikipedia.org/wiki/Host-based_intrusion_detection_system
   
   
   
3. Phishing : criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by concealed as a trustworthy entity in an electronic communication. Communications purporting to be from popular social web sites, auction sites, online payment processors or IT administrators are commonly used to lure the unsuspecting public.
   
   Phishing is typically carried out by e-mail or instant messages and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one. Even when using server authentication. it may require tremendous skill to detect that the website is fake.
   
   
   A phishing technique was described in detail in 1987, and the first recorded use of the term "phishing" was made in 1996. The term is a variant of fishing, probably influenced by phreaking and alludes to baits used to "catch" financial information and passwords.
   
   References:
   
   What is Phishing?. Retrieved on May 26, 2010 from http://www.webopedia.com/TERM/P/phishing.html
   
   Phishing. Retrieved on May 26, 2010 from http://en.wikipedia.org/wiki/Phishing
   
   
   
4. Secure Electronic Transaction (SET) is system that ensures the security of financial transaction via the internet. During a financial transaction, purchaser, merchants and purchaser's bank are verified and the transaction is conducted after the parties involved exchanges digital certificates. This process makes the transaction transparent, secure and confidential.
   
   Secure Socket Layer(SSL) on is a standard that encrypts the data between Web Server and a Web Browser. It helps improve the communication in the Internet. SSL is built in over the all of the major browsers and web-servers which turns on the SSL capabilities by simply installing the digital certificate.
   
   Although more secure, SET is less common is use than SSL because of its high cost as well as its complexity to be implemented. implementation of SET involves the installation specific client software to handle SETs.
   
   Reference:
   Secure Electronic Transaction. Wikipedia. 2010.Wikimedia Foundation, Inc. Retreived on May 25, 2010 from http://en.wikipedia.org/wiki/Secure_Electronic_Transaction
   
   Secure Electronic Transaction: An Overview. Retrieved on May 25, 2010 fromhttp://www.davidreilly.com/topics/electronic_commerce/essays/secure_electronic_transactions.html
   
   SSL versus SET, Clough G. (n.d), retrieved on May 25, 2010 from : http://www.savagerun.com/SSLSET.htm
   
   What is secure electronic transaction?, retrieved on May 25, 2010 from : http://searchfinancialsecurity.techtarget.com/sDefinition/0,,sid185_gci214194,00.html
   
   
   
5. 
   
   A cookie, also known as a web cookie, browser cookie, and HTTP cookie, is a text string stored by a user’s web browser. A cookie consists of one or more name value pairs containing bits of information, which may be encrypted for information privacy and data security purpose. A cookie can be used for authentication, session tracking, storing site preferences, and shopping carts contents, the identifier for a server-based session or anything else that can be accomplished through storing textual data.
   As text, cookies are not executable. Because they are not executed, they cannot replicate themselves and are not virues.However, due to the browser mechanism to set and read cookies; they can be used as spyware. Anti-spyware products may warn users about some cookies because cookies can be used to track people—a privacy concern.
   Some drawbacks of cookies are as follows:-
   Besides privacy concerns, cookies also have some technical drawbacks. In particular, they do not always accurately identify users, they can be used for security attacks, and they are at odds with the Representational State Transfer (REST) software architectural style.
         a.      Inaccurate identification
   If more than one browser is used on a computer, each usually has a separate storage area for cookies. Hence cookies do not identify a person, but a combination of a user account, a computer, and a Web browser. Thus, anyone who uses multiple accounts, computers, or browsers has multiple sets of cookies.
   b.        Cookie hijacking A cookie can be stolen by another computer that is allowed reading from the network Cross-site scripting: a cookie that should be only exchanged between a server and a client is sent to another party.Cookie poisoning: an attacker sends a server an invalid cookie, possibly modifying a valid cookie it previously received from the server.
   c.        Cookie theft The cookie specifications constrain cookies to be sent back only to the servers in the same domain as the server from which they originate. However, the value of cookies can be sent to other servers using means different from the Cookie header.
   d.      Cookie poisoning While cookies are supposed to be stored and sent back to the server unchanged, an attacker may modify the value of cookies before sending them back to the server. If, for example, a cookie contains the total value a user has to pay for the items in their shopping basket, changing this value exposes the server to the risk of making the attacker pay less than the supposed price. The process of tampering with the value of cookies is called cookie poisoning, and is sometimes used after cookie theft to make an attack persistent.
   In cross-site cooking, the attacker exploits a browser bug to send an invalid cookie to a server.
         e.     Cross-site cooking
         f.      Inconsistent state on client and server
   g.     Cookie expiry
   
   References:
   HTTP cookie. Wikipedia. 2010.Wikimedia Foundation, Inc. Retreived on May 25, 2010 from http://en.wikipedia.org/wiki/HTTP_cookie
   
   What are Computer Cookies?, Kayne R. (2010), Retrieved on May 25, 2010 from http://www.wisegeek.com/what-are-computer-cookies.htm
   
   
   
6. 
   
   A firewall is a part of a computer system or network that is designed to block unauthorized access while permitting authorized communications. It is a device or set of devices which is configured to permit or deny computer applications based upon a set of rules and other criteria.
   Firewalls can be implemented in either hardware or software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.
   Some firewall vendors that could be found over the internet:

   - Zone Alarm PRO firewall 2010:  provides firewall and anti-spy protection software only.

   - Prisma Firewall : provides firewall software only.

   - WatchGuard FireBox X6500e : tprovides both hardware and software for the firewall

   
   Reference:

   Firewall (computing). Wikipedia. 2010.Wikimedia Foundation, Inc. Retreived on May 7, 2010 from http://en.wikipedia.org/wiki/Firewall_(computing)

   
   

   Best Firewall Software - Editors choice. Retreived on May 7, 2010 from

   http://www.all-internet-security.com/top_10_firewall_software.html
   

   
   
7. 
   
   In order to create trust among the potential customers, e-commerce should provide necessary security measurement on both networking and transactional basis. According to Gaebler.com, there are three ways to convey trust on the electronic business:
   E-commerce Security
   To prevent customer's from virus or network intrusion, the corporate should deploy different security products to protect their internal infrastructure (e.g. servers, database, etc) from external attacks and to secure the data transactions between the web servers and clients' browsers. Protection of internal infrastructure can be achieved by implementing firewalls, intrusion detection systems, etc. Data transactions in the Web can be secured by SSL, digital certificates, etc.
   Privacy in e-commerce transactions
   Customers are concerned about the purpose and the way that the company will use their personal details and financial information. The company can set out its privacy policy and ask for customer's agreement in his membership registration.
   E-commerce reliability
   Last but not the least, the key to success is to fulfill customer's needs as soon as possible. This is the matter of service levels. Good reputation can be cultivated by timely delivery of goods, great customer services, etc.
   Quality certifications are also necessary to be provided and available to be verified by the customer. There are third parties to certify and provide the certificates of trust and seals of approval for e-commerce web sites for example, TRUSTe (www.truste.org), BBBOnline (www.bbbonline.org), Verisign (www.verisign.com), etc. Customers can verify the e-commerce web sites through these certificates as baseline measurement.
   
   
   References:
   Gaebler.com. (2010). Conveying Trustworthiness in E-Commerce. Retrieved 28 May 2010 from: http://www.gaebler.com/Conveying-Trustworthiness-in-E-Commerce.htm
   
   
   
8. 
   
   Pretty Good Privacy (PGP) was created by Philip Zimmermann in 1991.It is a computer program that provides cryptographic privacy and authentication. PGP is often used for signing, encrypting and decrypting e-mails to increase the security of e-mail communications.
   PGP encryption uses a serial combination of hashing, data compression, symmetric-key cryptography, and, finally, public-key cryptography; each step uses one of several supported algorithms. Each public key is bound to a user name and/or an e-mail address. The first version of this system was generally known as a web of trust to contrast with the X.509 system which uses a hierarchical approach based on certificate authority and which was added to PGP implementations later. Current versions of PGP encryption include both options through an automated key management server are:-Compatibility, Digital, signatures, Certificates, Security quality
   
   In August 2002, several ex-PGP team members formed a new company, PGP Corporation, and bought the PGP assets (except for the command line version) from NAI. The new company was funded by Rob Theis of Doll Capital Management (DCM) and Terry Garnett of Venrock Associates. PGP Corporation supports existing PGP users and honors NAI's support contracts. Zimmermann now serves as a special advisor and consultant to PGP Corporation, as well as continuing to run his own consulting company. In 2003, PGP Corporation created a new server-based product called PGP Universal. In mid-2004, PGP Corporation shipped its own command line version called PGP Command Line, which integrates with the other PGP Encryption Platform applications. In 2005, PGP Corporation made its first acquisition—the German software company Glueck and Kanja Technology AG, which is now PGP Deutschland AG. In 2010, PGP Corporation acquired Hamburg-based certificate authority TC TrustCenter and its parent company, ChosenSecurity, to form its PGP TrustCenter division Since the 2002 purchase of NAI's PGP assets, PGP Corporation has offered worldwide PGP technical support from its offices. On April 29, 2010 Symantec Corp. announced that it will acquire PGP for $300 million with the intent of integrating it into its Enterprise Security Group.
   
   
    

Exercise 8: XML introduction

Create an XML document for an online catalogue of cars where each car has the child elements of make, model, year, colour, engine, number_of_doors, transmission_type and accessories. The engine has child elements called number_of_cylinders and fuel_system.

<?xml version=”1.0? encoding=”utf-8??>
<catalogue>
<make></make>
<model></model>
<year></year>
<colour></colour>
<engine>
<number_of_cylinders></number_of_cylinders>
<fuel_system></fuel_system>
</engine>
<number_of_doors></number_of_doors>
<transmission_type></transmission_type>
<accessories></accessories>
</catalogue>
<body>
<form name = "shop-test" action="" method="get">
<table>
<tr><td>Name: </td><td><input name="nama" type="text"/></td></tr>
<tr><td>Card: </td><td><input name="kartu" type="text" /></td></tr>
<tr><td>Number: </td><td><input name="nomer" type="text" /></td></tr>
<tr><td>Order: </td><td><input name="pilih" type="text" /></td></tr>
<tr><td></td><td><input type="Submit" name="submit1" value="Submit" onClick="readText(this.form)"></td></tr>
</form>
</body>
</html>

Exercise 7: Application server platforms in e-commerce

Question

1. Why is the perception getting stronger that integration will become a critical factor in coming days?

2. What is the relationship of AJAX to JQuery (jquery.com) and the lightweight Web 2.0 javascript framework called MooTools (mootools.net) within the enterprise software architecture?

3. What are the similarities between the object-oriented development using model-view-controller (MVC) in Ruby on Rails 2.0 and Action Script 2.0 (Flash animations)?

4. What does it mean to develop RESTful practices into our web applications?

Answers

1

This is because, as the business world grows even more competitive by the day and demands an ever increasing number of efficiency. Technology is demanded to provide solutions for the businesses as efficient as possible and as fast as possible. Thus software development would endure a construction development revolution in which a piece software could be made up of various different programming language, using various different modules that might not be possible to be done without advancements in integration technologies.

A very good example of this is XML. XML provides its users the ability to have a fully integrate able language which are supported across many programming languages, software modules and even database systems. How does XML really does it ? For example if we were to have two companies Y and Z. Y is using Oracle database to manage its transactions.For some reason, Y needs to export a certain part of the database to its new partner company Z who are using a different database technology which are not fully compatible with Oracle to store their data. To overcome this problem, the data from company Y can be exported as an XML data into company Z's database which will automatically identify it as an XML record and now could update itself with the required data from the XML file.

2

AJAX - Asynchronous JavaScript and XML

used for developing light weight web applications that retrieves needed data without interfering with the page's display by handling post-backs. This means users will not have to experience a full page load in pages implementing AJAX for its data retrieval which significantly increases the user friendly-ness of a data-laden web page which sometimes could become a hassle, especially on slow connections.

jQuery & Motools

jQuery & Mootools is an open-source, lightweight, cross-browser javascript library. Both are similar in its purpose such as one is the alternate to the other. Besides its lightweightness these frameworks supports many of the current web 2.0 standards , also supports creation of animations and widgets. Currently, jQuery is dual licensed by MIT License and GNU GPL while Motools is licensed by MIT.

3

The similarity between Ruby on Rails 2.0 and Action Script 2.0 (Flash animations) is that they are both using the same approach ( utilizing MVC for object oriented design), both are class based and rapid development oriented. The only significant difference is the intended usage of the softwares. users will find Ruby on Rails are more into web development while Action Script is mostly used for animations.

4

REST(Representational State Transfer)ful web applicationis a simple web service implemented using HTTP and the principals of REST. REST itself is a style/architecture for a web service / application. The key goal in complying with REST is to make inter-connectivity and compatibility between web applications and services possible.

References

AJAX(n.d.). Retreived April 12, 2010, from http://en.wikipedia.org/wiki/Ajax_(programming)

jQuery(n.d.). Retreived April 12, 2010, from http://en.wikipedia.org/wiki/JQuery

MooTools(n.d.). Retreived April 12, 2010, from http://en.wikipedia.org/wiki/Mootools

PureMVC(n.d.). Retreived April 12, 2010, from http://en.wikipedia.org/wiki/PureMVC

PureMVC Standard for AS2(n.d.). Retreived April 12, 2010, from http://trac.puremvc.org/PureMVC_AS2

PureMVC Standard for Ruby(n.d.). Retreived April 12, 2010, from http://trac.puremvc.org/PureMVC_Ruby/

Representational State Transfer(n.d.). Retreived April 12, 2010, from http://en.wikipedia.org/wiki/Representational_State_Transfer

Exercise 6: Web form design and processing: A basis for e commerce interaction

1. Design the form

'Retrofit' the form data string below:

name=Evan+Burke&card=Visa&number=8443261344895544&order=French+perfume

for buying some French perfume into the HTML form fields and submit button on the Web page form.

Source Code for the order form:

<html>
<head>
    <title>Order</title>
</head>
<body>
<form action="order.htm" method="get">
<table>
<tr><td>Name: </td><td><input name="name" type="text"/></td></tr>
<tr><td>Card: </td><td><input name="card" type="text" /></td></tr>
<tr><td>Number: </td><td><input name="number" type="text" /></td></tr>
<tr><td>Order: </td><td><input name="order" type="text" /></td></tr>
<tr><td></td><td><input type="submit" value="submit" /></td></tr>
</form>
</body>
</html>

Screenshot:

2. Script archives exist for PERL, Python and JavaScript. Search the Web for a script that processes the HTML forms data. Read the code and list the steps involved in processing the form.

JavaScript:

html>
<head>
<title>Javascript Test</title>
<script language="JavaScript">
function readText (form){
   TestVar = form.inputbox.value;
   document.write ("You have entered: " +TestVar);
}
</script>
</head>
<body>
<form name = "javascript test" action="" method="get">
Enter test string: <br>
<input type="text" name="inputbox" value=""><P>
<input type="button" name="button1" value="Read" onClick="readText(this.form)">
</form>
</body>
</html>

Screenshot:

Output:

3. Can you modify the script to process the form?

Yes, I could modify the script to process the order form, but it would be futile as in real practice, processing the data on the form would be done by passing the data from the input boxes on to the server and commonly followed on to the database for updating.

For testing purposes, I am modifying the above script to forward the input entered to the form into text labels in the browser

Source Code:

<html>
<head>
<title>Javascript Test</title>
<script language="JavaScript">
function readText(form){
    Name=form.nama.value;
    Card=form.kartu.value;
    Number=form.nomer.value;
    Order=form.pilih.value;
    document.write ("<p>Name : " + Name + "<br>Card : " + Card + "<br>Number : " + Number + "<br>Order : " + Order +"<p>");
}
</script>
</head>
<body>
<form name = "shop-test" action="" method="get">
<table>
<tr><td>Name: </td><td><input name="nama" type="text"/></td></tr>
<tr><td>Card: </td><td><input name="kartu" type="text" /></td></tr>
<tr><td>Number: </td><td><input name="nomer" type="text" /></td></tr>
<tr><td>Order: </td><td><input name="pilih" type="text" /></td></tr>
<tr><td></td><td><input type="Submit" name="submit1" value="Submit" onClick="readText(this.form)"></td></tr>
</form>
</body>
</html>

Screenshot:

Output:

4. Improve the user experience by add a Javascript feature.

I am adding a drop-down list feature for card selection as well as a number auto-validation to ensure that the entered data in the numbers field are always numeric. This is done by adding the display() function for the drop-down list and function isNumber() to validate the numerical data. In the display() function, users will be prompted by a message box with a reminder to enter their details.

Source Code:

<html>
<head>
<title>Javascript Test</title>
<script language="JavaScript">
function readText(form){
    Name=form.nama.value;
    Card=form.kartu.value;
    Number=form.nomer.value;
    Order=form.pilih.value;
    document.write ("<p>Name : " + Name + "<br>Card : " + Card + "<br>Number : " + Number + "<br>Order : " + Order +"<p>");
}

function display()
{
var tmp = document.shoptest.kartu.selectedIndex;
var selected_text = document.shoptest.kartu.options[tmp].text;
alert("Your have selected : " +"\n" + selected_text +" Card"+"\n please enter the required details");
}

function IsNumber() {
    if (event.keyCode>='0'.charCodeAt()&&event.keyCode <= '9'.charCodeAt())
        event.returnValue = true;
    else
        event.returnValue = false;
}

</script>
</head>
<body>
<form name = "shoptest" action="" method="get">
<table>
<tr><td>Name: </td><td><input name="nama" type="text"/></td></tr>
<tr><td>Card: </td><td><select name="kartu" onChange="display()">
        <option value = "VISA">VISA
        <option value = "MASTERCARD">MASTERCARD
        <option value = "AMEX">AMEX
        <option value = "DINERS">DINERS
        </select></td></tr>
<tr><td>Number: </td><td><input name="nomer" type="text" onkeypress="return IsNumber(this.name);" /></td></tr>
<tr><td>Order: </td><td><input name="pilih" type="text" /></td></tr>
<tr><td></td><td><input type="Submit" name="submit1" value="Submit" onClick="readText(this.form)"></td></tr>
</form>
</body>
</html>

Screenshot

Output