![](bg6.png)
(section 5). The "DOCENT" DLS security is
provided by its functioning logic. It realizes
protection against the most probable attacks. It is
supposed that an intruder is an authorized EP user
with only a browser (including those used in the
mobile phones and pocket PCs). However it is
enough for example to read the Web page contents
and the entire client side scripts, which for example
are not referenced anywhere (for example to the
page, where correct answers to the quizzes are
shown). He/she can transfer any parameters
including forge ones. The EP security subsystem
detects all these activities, reacts in an appropriate
way and logs any attempts to compromise the EP.
Security subsystem logic consists of several
business classes, incorporating all functionality
supplied by the described in Figure 2 servers plus
logging audit messages about all actions performed
by the users. Protection against information
substitution and deleting is also implemented via
strict access control. The authentication scheme is
based on the data, never saved to disk and destroyed
if the browser is closed. All administration pages are
accessible only through the HTTPS connections.
Because the clear-text password can be sniffed the
administrators are required to authenticate
themselves to the EP with their personal certificates.
Payload protection protocols used are SSL/TLS with
encryption facilities.
The "DOCENT" DLS is used very effectively in
the University’s DL process for the University’s
students, bachelors and masters (as a part of the
blended learning), at the short-term training courses
and during an assessment of the trainees from the
other Russian universities and NRNU MEPhI’s
partners (when we serve as a certification center).
More than 10000 learners of different ages and
preliminary education have already experienced all
its advantages.
The "DOCENT" DLS is permanently improved.
Its first versions suffer from a few typical attacks as
data sniffing and DoS attacks. Their analysis showed
the need to protect information in almost all stages
of DL process. Stronger protection against attacks
on EP communication channels and counteraction to
DoS and DDoS (distributed DoS) attacks are going
to be implemented.
7 CONCLUSIONS
Our many years’ experience shows motivation of IS
implementation expedience for EP and that to
resolve DL IS issues completely and generally is a
very hard task. DLS as they use network protocols,
operational systems, databases management
systems, different network services, Web
applications, APIs etc. always inherit their
vulnerabilities. A generalised EP structure as a
protection object is created and the key security
requirements and functional security subsystem
components of a secure EP are developed. A secure
EP on the basis of "DOCENT" DLS (UNIAR) being
used in the NRNU MEPhI is shown.
In any modern DLS proactive EP security
against new more and more sophisticated attacks is
very welcome, but at present unfortunately nobody
knows how to realize it in DL. The only way to
reach the higher level of the DLS security is to
conduct a full IS risk processing cycle for a concrete
DLS in its particular content. After all IS objects,
threats, vulnerabilities and risks will be defined and
estimated it will be possible to create an adequate
DLS security subsystem as it described below.
REFERENCES
Diatchenko, J., Miloslavskaya, N., Tolstoy, A., 2001.
Problems in Designing Secure Distance Learning
Systems. In Proceedings of the 2st World Conference
on Information Security Education WISE2. Australia,
Perth. Pp.147-159.
Furnell, S. M., Karweni, T., 2001. Security issues in
Online Distance Learning. In VINE, Vol 31, Iss 2.
Jonas, X. Yuan, 2008. Liferay Portal Enterprise Intranets.
Packet Publishing. 408 p.
Kavun, S., Sorbat, I., Sorbat, I., 2012. Distance Learning
Systems and their information security. In Business
Inform, Iss 7, pp. 234-239.
Miloslavskaya, N., Tolstoy, A., 2003. Distance Learning
and Virtual Private Networks. In Proceedings of the
eLearning, eMedicine, eSupport Conference "Viewdet-
2003”. Austria, Vienna.
Miloslavskaya, N., Tolstoy, A., 2004. Problems of
Distance Progress Testing. In Proceedings of the
EDEN 3rd Research Workshop. Germany, Oldenburg.
Samson, T., 2012. 9 top threats to cloud computing
security. http://www.infoworld.com/t/cloud-security/
9-top-threats-cloud-computing-security-213428 (last
access date 18/10/2013).
Siciliano, R., 2013. Distance Learning Poses Serious Data
Security Issues, http://www.huffingtonpost.com/
robert-siciliano/distance-learning-poses-s_b_3938096.
html (last access date 18/10/2013).
CSEDU2014-6thInternationalConferenceonComputerSupportedEducation
432