Security
Architecture
Advactory uses a client/server architecture. The client is a Progressive Web App (PWA) that communicates with the application server over an API. The application server interacts with several microservices and the databases.
File Uploads
Authenticated users can upload files to the platform. These are limited to 64MB in size, and the following file types:
- text, markdown, csv
- image
- video
- word processing
- spreadsheet
- presentation
Passwords
Complexity
Administrators can configure the required password complexity for their organization. After activation, users will have to change their password upon login if its complexity does not meet the requirements. The following options are configurable:
- Password length
- Character sets
- Maximum password age
- Password history
MFA
Users can activate MFA in their account settings. Advactory currently supports two MFA options: By Authenticator app and by email.
Administrators can enforce the organization-wide use of MFA. This is done separately for each of the three user roles, and for each of the supported MFA options. Once activated, users will have to set up MFA on their next login.
Reset
Users with a registered email address can request a password reset mail by clicking on the I can't remember my password button on the login screen. This will send out an email containing a password reset token that is valid for two days.
Users without an email address must request their administrators to reset their password.
Hashing
Passwords are hashed before they are stored in the database. The hash algorithm used is BCrypt, with a salt length of 10.
Session Expiration
User session expires after 8 weeks.
IoT Integration
Sensor data is protected end-to-end via the LoRaWAN protocol, wich is encrypted and authenticated (AES-128, AES-CTR, AES-CMAC). Gateways transmit additional measurement data via MQTTS, a secure TLS-encrypted version of MQTT.