CONTENTS

S.No.

Page No.

CERTIFICATE
DECLARATION
ACKNOWLEDGEMENT
ABSTRACT
INTRODUCTION

1.1 ORGANIZATION PROFILE.

1.2 SYSTEM SPECIFICATION

1.2.1 HARDWARE CONFIGURATION

1.2.2 SOFTWARE SPECIFICATION

SYSTEM STUDY

2.1EXISTING SYSTEM

2.1.1 LIMITATIONS OF EXISTING SYSTEM

2.2 PROPOSED SYSTEM

2.2.1 ADVANTAGES OF PROPOSED SYSTEM

2.2.2 MODULE DESCRIPTION

SYSTEM DESIGN AND DEVELOPMENT

3.1 INPUT DESIGN

3.2 OUTPUT DESIGN

3.3 DATABASE DESIGN

3.4 FORM DESIGN

SYSTEM TESTING

SYSTEM IMPLEMENTATION

CONCLUSION.

5.1 CONCLUSION

SCOPE OF FUTURE ENHANCEMENT

BIBLIOGRAPHY

ANNEXURE
A. DATA FLOW DIAGRAM
B.TABLE STRUCTURE
C.SAMPLE CODING
D.SCREEN SHOTS.

ACKNOWLEDGEMENT
First of all we thank God Almighty for his blessings without which we
would have not initiated the project.
We would like to express our sincere gratitude to The Most
Rev.S.Vasanth kumar, Moderator, Bishop In charge of Coimbatore.
We are thankful to our Principal,, Ph.D., who has been a source of
inspiration throughout the project.
We are indebted to Prof.MS. RENUKA H.O.D. of IT Department whose
support we have completed our project successfully.
We are grateful to our internal guide Ms.RAMAJAYAM ,Lecturer of IT
Department for his valuable guidance in our project.
We would also like to thank the faculty members and supporting staff,
who extended their selfless help for the completion of our project. We would
also like to thank our dear friends for their active ideas for the improvement of
the project.
Most of all we extend our indefinable thanks to our parents for their
blessing without which all this would not have been possible.

ABSTRACT
Cryptographic algorithms are designed around computational hardness
assumptions, making such algorithms hard to break in practice by any
adversary. Many symmetric and public key algorithms are given which are
hard to break in practice by any adversary. There exist theoretically secure
schemes that provably cannot be broken. However, these schemes are more
difficult to implement than the very best theoretically breakable but
computationally secure mechanisms. This paper develops an enhanced version
of multilingual key generator, which will generate our cryptographic key with
the help of various new and better code schemes. We have tried to increase the
computational hardness and keeping it simple. The proposed paper will try to
give a better and secure method to generate cryptography key by sender.

When considering the threats posed by cryptography, it is important to

recognize that only the use of encryption for confidentiality, including
anonymity, presents a problem. The use of cryptography for data integrity and
authentication, including digital signatures, is not a threat. Indeed, by
strengthening the integrity of evidence and binding it to its source,
cryptographic tools for authentication are a forensic aid to criminal
investigations. They also help enforce accountability. Because different
cryptographic methods can be employed for confidentiality and authentication,
any safeguards that might be placed on encryption to counter the threats need
not affect authentication mechanisms or system protocols .
To this, we are using multilingual cryptography to encrypt data in
different languages with secured privacy. Group-oriented cryptography has been
intensively studied recently. Different from the conventional single-sendersingle-receiver public key cryptography model, the entities of group-oriented
cryptography are a group of users of an organization, either a hierarchic
organization or a at one. The multilingual cryptography algorithm which is

focuses on encryption of plain text over a range of languages supported by a

Unicode.
Keywords: Unicode, decryption, encryption, key generator, crypto
analysis

INTRODUCTION
For many centuries, cryptography has been, and will continue to be used
for protection of information and enabling of secret communications, for both
individuals and states. The earliest forms of cryptography used a simple monoalphabetic frequency analysis. As cryptographers developed new and stronger
methods for encrypting, the time taken to break the encryption increased.
Substitution changing a single letter for another for each letter of the alphabet.
This simple form of encryption is easily broken by cryptanalysts employing.
Cryptography was winning the battle but during the Second World War,
development of a universal Turing machine (the for -runner of the modern
computer) by Alan Turing, at Bletchley Park, and utilizing the cryptanalysis
work of Pole Marian Rjewski enabled the British to read the Germ an Enigma
communications, the battle was over, literally. The next 50 years saw the
computer develop into the machine most of us have sitting on our desktops
today, each year becoming smaller and faster. The requirement of secure
communications now supports, not only governments and individuals, but also a
new revolution in commerce, e-commerce. New forms of cryptography have
evolved to build this new world of; confidentiality, authentication, non
repudiation, and integrity, but while this work well in the here now, with the
advent of the quantum computer on the horizon classical cryptography is
threatened.

Some background
Symmetric cryptography:
In order to appreciate the future of cryptography we
need to explore its past, expose the weakness, that have forced the
advancement of cryptographic technology. Early ciphers substituted each of

the letters of the alphabet with another letter, e g. if each letter is shifted by
three, a D, b E, ,s V you get the following: a simple message
Becomes: D VLPSOH -PHVVDJH
The key to this encrypted message is-the alphabet has been shifted by
three letters, and that shifting back by three letters is the key to decrypting the
message. Note that the key is the same to encrypt and decrypt and therefore
must be secret to both the sender and receiver. Anyone with this knowledge can
decrypt the message (confidentiality attack), or encrypt a message
(misinformation, integrity attack). This is secret key or symmetric key
cryptography, this example of a mono -alphabetic substitution cipher is known
as a Caesar shift cipher, used by Julius Caesar in the Gallic wars 58 50
Encrypting the message is achieved by the use of a key word, which must
remain secret between the sender and receiver. The key determines which
substituted alphabet is used to encrypt that letter, creating a poly -alphabetic
cipher text. The encryption is performed as follows: The key word is written
above the plain text repeatedly to cover the entire message, the letters in the
key word indicate the cipher row to be used and the intercept of the plain text
on this row produces a cipher letter, this process is then repeated for each
letter of the key stream.
e g. If the secret key word is SECRET, we
Key

SECRETSECRETSE

Plain text

a simple message

Cipher text , SWKDTEWQGJWTH

Asymmetric cryptography:
Algorithms such as RSA and ECC use a two key system,
one key for encryption (public) and another key for decryption (private). They
can also be used in reverse for authentication but I will not pursue this here.
Asymmetric cryptography or public key cryptography solves the problem of
key distribution very nicely. It is a slower method of encryption than say triple
DES (Data Encryption Standard) and key lengths required offering similar

strengths to symmetric systems are much longer.

MULTILINGUAL CRYPTOGRAPHY
The rapid growth of internet in the recent days and the wide spread availability of
networks have to the development of powerful and creative applications. Almost all the software
applications are becoming online, not to mention the Google Docs and Microsoft Office Live.
Hence, the networks have become more open and accessible. Consequently, an adversary is not
limited to eavesdropping but may take a more important role by activities like a Man in the
Middle Attack. The last decade witnessed a lot of these attacks. Therefore, the security for the
huge amount of data transferred is at stake. The science of Cryptology dates back to Caesars
time. Since then, a variety of heuristics have been proposed for secured communication. But,
cryptanalysis has simultaneously cracked these encryption techniques from time to time.
Security is an important issue in communication and storage of messages, and encryption
is

one the way to ensure security. The key is the soul of any cryptographic algorithm. If the key

is weak then the data encrypted using that key can be easily decoded by cryptanalyst .In this
paper, we focus on key generation using multilingual to translate plain text and then to generate
key using it.

Requirements of cryptography
Cryptography must ensure that, the unaltered content of a communication is exposed only to the
intended receiver(s) integrity and confidentiality.

Problem
From the early time, messages were written in the language known by both the parties,
i.e., sender and receiver. Even after encrypting the message, cipher text has the characters of the
same language in which the plain text was. Even the cryptographic keys were in the same
language; in cases where key were word(s). In recent times, we use English language as a

standard for communication. ASCII code scheme is use to represent English language symbols,
Arabic numbers and some special symbols which are used frequently. ASCII code scheme
based key were used, whose symbol values, which are in binary, are used to generate final
key(s) after applying some mathematical functions. Cryptanalyst or a computer program only
work upon these schemes to find the key of encrypted information.

It is not difficult to break the encrypt text in binary form.

Solution:
With respect to computing basic unit of information in binary format, multilingual
Key generator is used. So that, key is generated then the information is encrypted in different
languages. This is too critical to hack the encrypted data. In this paper, we using five different
languages such as chinese, Japanese, Arabic , symbols ,numbers .

1.1 ORGANIZATION PROFILE

History
Netcom Online Solutions India Pvt Limited is a R&D and manufacturing company of
Electronic GSM Anti-theft & GPS Tracking devices for retail and commercial applications.
Backed by industry veterans and professionals having strong knowledge in GSM / GPS / RF

communication and Telematics, our objective is to make simple yet effective devices to prevent
theft and increase remote awareness.
With our comprehensive and cutting edge Research lab and manufacturing facility in
Coimbatore, we intent to serve and delight customers across the globe with our innovative
products and solutions.
Our core focus is to provide Anti-theft solutions for automotive, residential and
commercial segments, GPS tracking and awareness services for personal and fleets,
infrastructure and asset management services for industries and operators. Under our flagship
brand SUPERSAFE we have developed multiple products which will address and prevent to a
large extend automotive theft, burglary, kidnapping and break in.
Established on 2005, Netcom emerged as a leader in the deployment of network
technologies including Structured Cabling, Wireless Infrastructure and Security Systems. This
business model provides a highly technical and well diversified installation and maintenance
force, which combined, enables us to handle large and more complicated projects. Much of the
technical force is cross trained enabling workforce to flow between projects

Vision
Our Vision is to be Global solutions provider of electronic security and Tracking systems
by providing most innovative and advanced products and services which meets our customers
expectation and market needs.
Mission
Netcom Online Solutions India Pvt Limited, through its people and processes, will
provide the highest quality and most innovative security and tracking solutions possible by
thoroughly understanding our customers' needs and Technology evolution.

Quality Policy
We are committed to meet our Customer's expectations by continually improving our
capabilities in Research, Design, Manufacturing and Support of the Products that we
manufacture.
We will strive to meet this goal consistently through

Manufacturing and supplying products of Highest quality and specification

Closely studying customers requirement and needs

Constant Up gradation of production technology and development process

Adhering delivery commitments

Training, Motivation and involvement of employees.

1.2. SYSTEM SPECIFICATION

Introduction:
A System Requirements Specification is a structured collection of information that
embodies the requirements of a system. System specifications help to define the operational and
performance guidelines for a system. It may outline how the system is expected to perform, and
what that may include. Key specifications may include interface definitions, document design
rules and functional areas.
When purchasing software or a computer, system specifications may be outlined during
the evaluation process and agreed upon during the payment process. The specifications may
determine security access. Many organizations will offer templates and resources to help

facilitate the adherence of system specifications. In some cases, system specifications can be
quite specific and difficult to follow without these guidelines

1.2 HARDWARE CONFIGURATION:

There are two types of system specification are Development process and execution process in
this project

DEVELOPMENT PROCESS: The development process involves a 3-part cycle:

Planning involves what area to develop and planning how to do this.

Acting involves practice. You will practice your personal and professional knowledge,

skills and attributes in everyday life as a student. However, the PPD Framework provide
further resources to help you practice.
Reviewing involves thinking about how good you were in practice and what you think

you could improve. It is also important to record your progress, as this helps you to become
more articulate about your knowledge, skills and attributes and to accurately assess your
development needs.

Hardware Requirements are

Processor: 2.4 ghz single core processor

1.5 gb of single channel memory

Memory space: 1GB of free disk space

Monitor:1024*768 pixels capable monitor

Software Requirement are

Operating system: Windows xp

Front end: Visual studio 2008 with C#

Back end: ms sql Server 2005

Information Server: IIS 5.1

IIS Resource Kit

EXECUTION PROCESS: This is where the work to deliver the product, service or wanted
result is carried out. Most of the work related to the project is realised at this stage and needs
complete attention from the project manager. The Executing Process Group consists of those
processes performed to complete the work defined in the project management plan to
satisfy the project specifications.
Server Configuration are

Windows based server

IIS 5.1 with Secure Channel Support

sql server 2005

500 mb of Hosting Space

Client Configuration are

Windows xp

.Net Framework 3.5

20

1.6 ghz Processor

512 mb RAM

10 mb Disk Space

800*600 Resolution Monitor

Internet Connection

1.3 SOFTWARE SPECIFICATION

1.4.1 VISUAL STUDIO C# 2008
Visual Studio 2008 provides developers with new ways to build smart clients. These
new features, which both enhance application functionality and improve developer
productivity, include easier design integration, expanded deployment options, more
versatile logon and personalization services, and better data access and
synchronization. Effective smart client development begins with good application
design. Visual Studio makes integrating UI designers into the development process
easier by supporting common formats such as Extensible Application Mark up
Language (XAML) and giving designers more direct control over the layout, controls,
and data binding of an applications UI. Designers can use familiar tools, such as the
Microsoft Expression Suite, to create UIs and produce files that developers can
work with directly in Visual Studio. Visual Studio supports a fully collaborative
workflow that enables designers and developers to hand work back and forth
directly and work in parallel.

Designers and developers can also build easily manageable and reusable
libraries of common UI designs, formats, and elements. Visual Studio 2008 also
provides developers with support for building native C++ applications that use the
Microsoft Office 2007 UI style, including the Ribbon Bar, Ribbon Status Bar, and
Mini-toolbar. Once built, applications need to be deployed efficiently.. A new set of
tools and classes in Visual Studio2008 simplify this integration. Developers can use
the same user profile and login services for their client applications as for their Web
applications.
This enables customers to use one method of back-end storage for user
personalization and authentication, regardless of the application type. Microsoft
Synchronization Services for ADO.NET provide an application programming With
Visual Studio 2008, developers can easily leverage new platform technologies to
deliver more compelling applications to their customers. Visual Studio enables
them to effortlessly incorporate new Windows Presentation Foundation features

into both existing Windows Forms applications and new applications. They can also
move their applications to the new Windows Vista look and feel easily with
enhancements to the Microsoft Foundation Class Library (MFC) and Visual C++.
Visual Studio 2008 also enables improved interoperability between native and
managed code. Visual Studio provides tools that enable developers who are early
adopters of Windows Presentation Foundation to build rich experience applications
quickly and easily. These tools include a designer and XAML editor, project
templates, debugging support, and deployment support. Developers can also use
Visual Studio 2008 to build applications that exhibit the Windows Vista look and feel
and take advantage of the more than 8,000 new native APIs available in Windows
Vista. A number of the Windows Vista look and feel features are available simply
by recompiling an MFC application. Deeper integration that requires more coding
or design work is also simplified with Visual Studios integrated support for the
Windows Vista native APIs. Visual Studio makes it easier to build applications that
leverage both native and managed code, and also delivers improved interoperability
performance. C++ developers have access to a new marshalling library that simplifies
data transfer across the native-managed (Standard Template Library (STL)Common Language Runtime) boundary for extending the STL into managed code.
These three pillars in Visual Studio 2008 enable developers to Rapid Application
Development. In Visual Studio 2008, developer productivity doesnt end with the
code editor and wizards.
By providing new tools and frameworks to simplify the tasks of developers,
designers, and database professionals for new application architectures and platforms,
Visual Studio 2008 not only delivers a productive development tool, but also enables
developers to tackle new business problems while decreasing the total cost of solution
construction.
Effective Team Collaboration. Visual Studio 2008 enhances the end-to-end value of
Visual Studio Team System by increasing its role-based coverage and delivering
enhanced traceability throughout the software development life cycle. With deep
integration across roles in the software life cycle and the Team Foundation Server,
Team System enables customers to amplify the impact of their teams and
improve software quality. Breakthrough User Experience. As users look for new

ways to comprehend and retain information, developers must still grapple with
basic desktop and application security. Visual Studio, Windows Vista, and the 2007
Office system enable developers to deliver a safe, robust, and compelling user
experience in any type of application. These fundamental advances enable customers
to rapidly create connected applications that deliver the highest quality, rich user
experiences regardless of project complexity or organization size.
1.4.2 SQL SERVER 2005
XML and Web services. SQL Server 2005 will support both relational and XML data
natively, so enterprises can store, manage, and analyze data in the format that best
suits their needs. Support for existing and emerging open standards such as Hypertext
Transfer Protocol (HTTP), XML, Simple Object Access Protocol(SOAP), XQuery,
and XML Schema Denition (XSD) will also facilitate communication across
extended enterprise systems. Business Intelligence The challenge and promise of
business intelligence revolves around providing employees with the right information,
at the right time. Accomplishing this vision demands a business intelligence solution
that comprehensive, secure, integrated with operational systems, and available all
day, every day. SQL Server will help companies to achieve this goal with SQL Server
2005. Business intelligence advancements will include: Integrated platform. SQL
Server 2005 will deliver an end-to-end business intelligence platform with integrated
analytics including online analytical processing (OLAP); data mining; extract,
transformation, and load (ETL) tools; data warehousing; and reporting functionality.
Improved decision making. Advancements to existing business intelligence features,
such as OLAP and data mining, and the introduction of a new reporting server will
provide enterprises with the ability to transform information into better business
decisions at all organizational levels. Security and availability. Scalability,
availability, and security enhancements will help to provide users with uninterrupted
access to business intelligence applications and reports. Enterprise-wide analytical
capabilities. An improved ETL tool will enable organizations to more easily integrate
and analyze data from multiple heterogeneous information sources.

By analyzing data across a wide array of operational systems, organizations may gain
a competitive edge through a holistic understanding of their business.
Additional Information SQL Server 2005 is part of the Windows Server System a
comprehensive and integrated server infrastructure that simplies the development, deployment
and operations of a exible business solution.

1.1 Overview of the Project

The Cryptographic techniques used only Single Language for Encrypting and Decrypting
purpose. This is an advantage for the hackers who can easily break the plain text .But in our
project; we use Multiple Language for transforming the messages. Only if the Cryptanalyst have
the knowledge of all the languages used, he can decrypt the message. The Key is also encrypted
up to 255 characters. Hence it has 255^255 combinations. This project is highly secure and is
used extensively in sending secret Information. The languages used here is Chinese, Japanese,
Tamil and also some Symbols

Objective of the Project

In this project, we use Multiple Languages for passing information. The protocol used
here is s-http (Secure-hypertext transfer protocol) which is more secure than the previously used
http (hypertext transfer protocol). We demonstrated our project by sending messages to web
server along with the key information. Only the authorized person can decrypt the message. This
will protect and handle the secret messages more efficiently.

2.2 EXISTING SYSTEM

The existing system uses cryptography. Cryptography is a technique used to hide the
meaning of a message. Cryptography, the use of codes and ciphers to protect secrets, began
thousands of years ago. The development of cryptography has been paralleled by the
development of cryptanalysis the "breaking" of codes and ciphers. This is different from
stegano graphic techniques in that one is not hiding the actual message, only the meaning of the
message. If a message were to fall into the hands of the wrong person, cryptography should
ensure that that message could not be read. Typically the sender and receiver agree upon a
message scrambling protocol beforehand and agree upon methods for encrypting and decrypting
messages. Cryptography is further divided into two implementation techniques and those include
transposition and substitution. Transposition is a cryptographic technique whereby the letters in a
message are rearranged to provide secrecy. Typically the sender and receiver agree upon a
technique to encode and decode messages using transposition. Substitution is a cryptographic
technique where each letter of the plaintext message is replaced by a different letter. Each letter
retains its original position in the message text, but the identity of the letter is changed .
The existing system uses only single language for encrypting purpose. Plain Text refers to
the human readable alphabet used to compose the original message. Cipher Text refers to the
encrypted plaintext message once the original letters in the message have been substituted with
the cipher alphabet. Ciphers are any form of cryptographic substitution applied to message text.
In cryptography, encryption is the process of encoding messages or information in such a way
that only authorized parties can read it Encryption does not of itself prevent interception, but
denies the message content to the interceptor. In an encryption scheme, the message or
information, referred to as plaintext, is encrypted using an encryption algorithm, generating
cipher text that can only be read if decrypted. For technical reasons, an encryption scheme
usually uses a pseudo-random encryption key generated by an algorithm.

It is in principle possible to decrypt the message without possessing the key, but, for a welldesigned encryption scheme, large computational resources and skill are required. An authorized
recipient can easily decrypt the message with the key provided by the originator to recipients, but
not to unauthorised interceptors. Symmetric key encryption. In symmetric-key schemes, the
encryption and decryption keys are the same. Communicating parties must have the same key
before they can achieve secure communication. In public-key encryption schemes, the
encryption key is published for anyone to use and encrypt messages .To encrypt the text,
encryption algorithm is used. Decryption is the reverse process to Encryption. Frequently, the
same Cipher is used for both Encryption and Decryption. While Encryption creates a
Cipher text from a Plaintext, Decryption creates a Plaintext from a Cipher text. An authorized
user can only decrypt data because decryption requires a secret key or password. To make the
data confidential, data (plain text) is encrypted using a particular algorithm and a secret key.
After encryption process, plain text gets converted into cipher text. To decrypt the cipher text,
similar algorithm is used and at the end the original data is obtained again. To break the plain
text the hacker must try 255^255 combinations.

2.2.1 LIMITATION OF EXISTIING SYSTEM:

If single language is used for encrypting, then the data is ciphered in binary bit form.
Although, it cannot be hacked easily by unauthorized persons, by assigning binary bit
encrypted data can be declared. The persons who familiar with certain language can
analyze plaintext. To overcome this, multilingual cryptography algorithm is used. Here
we use combinations of languages. It is very difficult to break the text.
In existing system only single user and single receiver can be view the information .To
make efficient usage, group oriented cryptography is used. In which sender can pass the
information to group of users.
Takes a long time to figure out the code. It takes long to create the code. If you were to
send a code to another person in the past, it will take long to get to that person. Overall

cryptography takes its a long process. The key size must be larger than the symmetric
cryptography to achieve same level of protection. public key cryptography is susceptible
to impersonation attacks.

2.2 PROPOSED SYSTEM:

The drawbacks of cryptography are frequently overlooked as well. The widespread
availability of unbreakable encryption coupled with anonymous services could lead to a situation
where practically all communications are immune from lawful interception (wiretaps) and
documents from lawful search and seizure, and where all electronic transactions are beyond the
reach of any government regulation or oversight. The consequences of this to public safety and
social and economic stability could be devastating. With the government essentially locked out,
computers and telecommunications systems would become safe havens for criminal activity.
Even May himself acknowledges that crypto anarchy provides a means for tax evasion, money
laundering, espionage (with digital dead drops), contract killings, and implementation of data
havens for storing and marketing illegal or controversial material. Encryption also threatens
national security by interfering with foreign intelligence operations. The United States, along
with many other countries, imposes export controls on encryption technology to lessen this
threat.
Encryption in modern times is achieved by using algorithms that have a key to encrypt
and decrypt information. These keys convert the messages and data into digital gibberish
through encryption and then return them to the original form through decryption. In general, the
longer the key is, the more difficult it is to crack the code. This holds true because deciphering an
encrypted message by brute force would require the attacker to try every possible key. To put this
in context, each binary unit of information, or bit, has a value of 0 or 1. An 8-bit key would then
have 256 or 2^8 possible keys. A 56-bit key would have 2^56, or 72 quadrillion, possible keys to
try and decipher the message. With modern technology, these numbers are becoming easier to
decipher; however, as technology advances, so does the quality of encryption. Since WWII, one

of the most notable advances in the study of cryptography is the introduction of the public-key.
These are algorithms that use a public key to encrypt, but a particular, private key to decrypt.
Beginning around the 1990s, the use of the Internet for commercial purposes and the
introduction of e-commerce called for a widespread standard for encryption. Before the
introduction of the Advanced Encryption Standard (AES), information sent over the Internet,
such as financial data, was encrypted using the Data Encryption Standard (DES), a symmetrickey cipher. This was used for its speed, as DES could scramble massive amounts of data at high
speeds. The problem with this was that over time, more users knew the key, and the risk of
security breaches increased. Around the late 1990s to early 2000s, the use of the public-key
became a more common approach for encryption, and soon a hybrid of the two schemes became
the way for e-commerce operations to proceed. Additionally, the creation of a new protocol
known as the Secure Socket Layer, or SSL, led the way for online transactions to take place.
Transactions ranging from purchasing goods to online bill pay and banking used SSL.
Furthermore, as wireless Internet connections became more common among households, the
need for encryption grew, as a level of security was needed in these everyday situations.

In spite of the fact that a wide variety of techniques have been employed for encryption
and decryption, making use of the multilingual approach is still not very common and prevalent.
This has motivated us about the propose a new novel algorithm that focuses on encryption of the
plain text over a range of language supported by Unicode. Making use of the mapping
techniques enable algorithm to become very fast efficient and easier to implement. Besides, the
replacement strategy adopted here ensures better safety and security. Cryptography is closely
related to the disciplines of cryptology and cryptanalysis. Cryptography includes techniques such
as microdots, merging words with images, and other ways to hide information in storage or
transit. However, in today's computer-centric world, cryptography is most often associated with
scrambling plaintext (ordinary text, sometimes referred to as clear text) into cipher text (a
process called encryption), then back again (known as decryption). Individuals who practice this
field are known as cryptographers.

2.2.1 ADVANTAGES OF PROPOSED SYSTEM:

The proposed system uses Multilingual Cryptography using SSL technique. The sender
passes the message along with the key information to the server. The receiver uses the
appropriate login information and can decrypt the message in the server. Only if he is the
authenticated user the key is generated automatically.
Multilingual cryptography concerns itself with the following four objectives:
1) Confidentiality (the information cannot be understood by anyone for whom it was
unintended)
2) Integrity (the information cannot be altered in storage or transit between sender and intended
receiver without the alteration being detected)
3) Non-repudiation (the creator/sender of the information cannot deny at a later stage his or her
intentions in the creation or transmission of the information)
4) Authentication (the sender and receiver can confirm each others identity and the
origin/destination of the information)

2.2.2 MODULES DESCRIBTION

BASE ALGORITHM
CLIENT APPLICATION
SERVER APPLICATION
SSL TRANSACTION

2.3 BASE ALGORITHM:

The base algorithm includes two modules i.e. one for encryption and other for
decryption. The encryption module describes the use of multiple languages in the plain text.
Chinese, Japanese, Hindi, Tamil, English etc. and also some symbols and numbers are used for
encrypting and decrypting purpose. A client application is made to ActiveX Control by using the
multi-tier architecture. The multi-tiered database architecture can be combined with ActiveX
features to distribute a client application as an ActiveX control. While distributing client
application as an ActiveX control, server application is created. When creating the client

application, Active Form is used as the basis instead of an ordinary form. Once after the client
application is build and deployed, it can be accessed from any ActiveX-enabled Web browser on
another machine. For a Web browser to successfully launch your client application, the Web
server must be running on the machine that has the client application.
If the client application uses DCOM to communicate between the client application and
the application server, the machine with the Web browser must be enabled to work with DCOM.
If the machine with the Web browser is a Windows 95 machine, it must have installed DCOM95,
which is available from Microsoft. Building a Multi-tiered Application .Creating a client
application .Creating a server application .The order of creation is important. To create and run
the server application before you create a client. At design time, you can then connect to the
server application to test your client. You can, of course, create a client without specifying the
server application at design time, and only supply the server name at run time. However, doing
so prevents you from seeing if your application works as expected when you code at design time.
You will also be unable to choose servers and providers using the Object Inspector. COM-based
servers need to be registered before being used. If you are not creating the client application on
the same system as the server, and you are using a DCOM connection, you may want to register
the application server on the client system. This makes the connection component aware of the
server application at design time so that you can choose server names and provider names from a
drop-down list in the Object Inspector. (If you are using a Web connection, SOAP connection, or
socket connection, the connection component fetches the names of registered providers from the
server machine.)
2.3.1 SOAP SERVER APPLICATION:
To create a server application. Start a new project. To use the new Data Snap technology, create
the Server application using the Data Snap Server Wizard or follow the steps mentioned in the
Tutorial: Using a Data Snap Server with an Application. If you are using SOAP as a transport
protocol, this should be a new Web Service application. Choose File > New > other, and on the
Web Services page of the new items dialog, choose SOAP Server application. Select the type of
Web Server you want to use, and when prompted whether you want to define a new interface for
the SOAP module, say no. For any other transport protocol, you need only choose File > New >
Application . Save the new project. Add a new remote data module to the project. From the main
menu, choose File > New > Other , and on the ActiveX, Delphi Files, or Web Services page of

the new items dialog, select Server Data Module, if you are creating a Data Snap server that
exposes the prototypes of its methods to the Client applications. Remote Data Module if you are
creating a COM Automation server that clients access using DCOM, HTTP, or sockets.
Transactional Data Module if you are creating a data module that runs under COM+ (or MTS).
Connections can be formed using DCOM, HTTP, or sockets. However, only DCOM supports the
security services. SOAP Server Data Module if you are creating a SOAP server in a Web Service
application. Place the appropriate dataset components on the data module and set them up to
access the database server. Place a Dataset Provider component on the data module for each
dataset you want to expose to clients. This provider is required for brokering client requests and
packaging data. Set the Dataset property for each provider to the name of the dataset to access.
Write application server code to implement events, shared business rules, shared data
validation, and shared security. When writing this code, you may want to extend the application
server's interface to provide additional ways for the client application to call the server. Provide
transaction support beyond the transactions automatically created when applying updates. Create
master/detail relationships between the datasets in your application server. Ensure your
application server is stateless. Divide your application server into multiple data modules. Save,
compile, and register or install the application server. Data Snap using dbExpress does not
require any runtime. If your server application uses TCP/IP sockets or HTTP connections, you
must install the runtime software that receives client messages, instantiates the remote data
module, and marshals interface calls. For HTTP connections this is httpsrvr.dll, an ISAPI/NSAPI
DLL that must be installed with your Web server.

2.3.2 Mapping:
The text to be encrypted is read character by character and the Unicode value of each is
obtained. This value is then divided by the mapping constant M. The remainder R so calculated
is used as the index of the mapping array ch_map and ch_map[R] is the corresponding encrypted
character forming the cipher text Enc. The quotient of the division is stored in another array Quo.
This quotient will be used in decryption. In a nutshell, remainder obtains the encrypted character
and the quotient has the key for decryption of the corresponding character. The cipher text Enc
may have repetition of characters. This is due to the fact that the encryption technique maps the
characters of the original message to the mapping array ch_map. Therefore, a replacement
strategy is incorporated and it checks for successive repetitions of characters. If such repetitive

patterns are found, they are replaced with a character in substitution array chno corresponding to
the number of repetitions. As this replacement strategy inserts non-regular characters into the
cipher text, cryptanalysis becomes a bit more difficult. Hence, the actual number of have been
employed for encryption and decryption, the use of a multilingual approach for the same is not
prevalent. Motivated by this, here, we propose a novel algorithm that focuses on characters in the
plain text is not evident from the cipher text. The probability of substitution of multiples to a
large extent depends on the Mapping constant M apart from the plain text.
The cipher text is scanned for characters in the substitution array chno. If chno[i] is
found to be a number m, the character preceding chno[i] in the cipher text is repeated m
number of times to obtain the temporary decrypted message. The characters in the temporary
decrypted message are compared with the mapping array ch_map. In case of a match, the
corresponding index of the mapping array is the remainder R. The Unicode values of the
characters of the original message are hence calculated by adding R to the product of M and
Quo. These values yield the
corresponding characters of the plain text and this account for the decryption procedure.

2.3.3 MULET ALOGRITHM:

The MULET algorithm basically consists of two functions viz. Encryption() and
Decryption() as described above. Encryption of the plain text followed by substitution of
multiples is used to obtain the cipher text. The transmitted encrypted message Enc is received by
the receiver as Dec. Undoing substitutions followed by decryption of the cipher text gives back
the original message. The function Encryption() takes as input a plain text and obtains the cipher
text enc as output. , the MULET algorithm is capable of encrypting messages from different
languages. This believe to be the characteristic feature of this algorithm which paves way for the
localization of software in cryptographic domain. It is also interesting to note that when we have
successive repetition of characters, then replacement strategy can be applied. This mechanism
effectively helps in hiding the number of characters in the cipher text thereby making it difficult
for the intruders to predict the message size. But, there also lies the trade off between
replacement and mapping constant which are inversely related. Security can further be enhanced
if we have a mapping array comprising of characters taken from different languages in Unicode.

In case of insertion of alien language characters in the array, the hackers of this encryption
method require the aid of a language expert. For example, if we take this algorithm for
encrypting Chinese text, and if we consider the mapping array to be in Devanagari (or any other
non local language), the ciphered text is going to be undecipherable for any local sniffer. The
trespasser, to initiate a brute force attack, must have the knowledge of different aspects of the
algorithm via, mapping constant, mapping domain and replacement strategy. Hence,
cryptanalysis is considered to be computationally complex. This implies that 1010 combinations
are to be tried to decipher, provided he has the knowledge of mapping domain and the quotients.
Although the amortized complexity of the encryption and decryption schemes is linear, yet we
find that the brute force attack is of exponential order. Hence, we believe MULET to be an
efficient encryption technique.

2 .4 Client Application
In most regards, creating a multi-tiered client application is similar to creating a twotiered client that uses a client dataset to cache updates. The major difference is that a multi-tiered
client uses a connection component to establish a conduit to the application server. To create a
multi-tiered client application. Add a new data module to the project.
Place a connection component on the data module. The type of connection component
you add depends on the communication protocol you want to use Set properties on your
connection component to specify the application server with which it should establish a
connection. To learn more about setting up the connection component, Set the other connection
component properties as needed for your application. For example, you might set 7the Object
Broker property to allow the connection component to choose dynamically from several servers.
Place as many TClient Data Set components as needed on the data module, and set the Remote
Server property for each component to the name of the connection component. Set the Provider
Name property for each TClient Data Set component. If your connection component is connected
to the application server at design time, you can choose available application server providers
from the Provider Name property's drop-down list. Client applications can invoke exposed server
methods. To do that, the proxies can be generated out of an active T SQL Connection connected
to a Data Snap server. To the end user, the client application of a multi-tiered application looks
and behaves no differently than a two-tiered application that uses cached updates. User
interaction takes place through standard data-aware controls that display data from a T Client

Data Set component. T Client Data Set fetches data from and applies updates to a provider
component, just as in two-tiered applications that use a client dataset with an external provider.
These connection components are summarized in the following table. The Client sends the
information to the server along with the key and passes code information. It makes use of secure
http protocol for transforming the information.
2.5 Server Application
A connection component is used to identify the protocol for communicating with the
application server. Each type of connection component represents a different communication
protocol. Indicate how to locate the server machine. The details of identifying the server machine
vary depending on the protocol.

The following points refer strictly to the COM-based

Application Server: Identify the application server on the server machine. Server Name identifies
the base name of the class you specify when creating the remote data module on the application
server. If the server is registered or installed on the client machine, or if the connection
component is connected to the server machine, you can set the Server Name property at design
time by choosing from a drop-down list in the Object Inspector. Server GUID specifies the
GUID of the remote data module's interface. You can look up this value using the type library
editor. The server connection is managed as Connection components can be used to create or
drop connections and to call application server interfaces. Usually, the application server is on a
different machine than the client application, but even if the server resides on the same machine
as the client application (for example, during the building and testing of the entire multi-tier
application), you can still use the connection component to identify the application server by
name, specify a server machine, and use the application server interface.
The server contains the encrypted message, key information, and also the information
about the authorized user who can decrypt the message. The authorized user once enters the
required password and other login information, if it is correct the key is automatically generated.
Now by using the key information the receiver can decrypt the message.

2.6 SSL Transaction

The Secure Sockets Layer (SSL) protocol uses certificates on the client and server to store
encryption keys. The server provides its SSL certificate when a connection is made so that the
client can verify the server identity. The server can also request a certificate from the client to
provide mutual authentication of both sides of the connection. Certificates are stored in a
centralized store according to the IP address and port number of the connection. The special IP
address 0.0.0.0 matches any IP address for the local machine. Note that the certificate store does
not distinguish URLs based on the path. Services with the same IP address and port combination
must share certificates even if the path in the URL for the services is different.
This procedure assumes that your site has already has a certificate assigned to it. Log on to
the Web server computer as an administrator .Click Start, point to Settings, and then click
Control Panel. Double-click Administrative Tools, and then double click Internet Services
Manager. Select the Web site from the list of different served sites in the left pane Right-click the
Web site, folder, or file for which you want to configure SSL communication, and then click
Properties. Click the Directory Security tab. Click Edit .Click require secure-channel (SSL) if
you want the Web site, folder, or file to require SSL communications. Click Require 128-bit
encryption to configure 128-bit (instead of 40-bit) encryption support .To allow users to connect
without supplying their own certificate, click Ignore client certificates. Alternatively, to allow a
user to supply their own certificate, use Accept client certificates.
To configure client mapping, click Enable client certificate mapping, and then click
Edit to map client certificates to users. In order to configure this functionality, a client certificate
is mapped to individual users in Active Directory. By using this functionality to automatically
identify a user according to the certificate they supplied when they access the Web site. Mapping
users to certificates on a one-to-one basis (one certificate identifies one user) or map many
certificates to one user (a list of certificates is matched against a specific user according to
specific rules. The first valid match becomes the mapping). Click OK.
2.6 PROTOCOLS USED IN TRANSACTION
2.6.1 Configuring HTTP and HTTPS
WCF services and clients can communicate over HTTP and HTTPS. The HTTP/HTTPS
settings are configured by using Internet Information Services (IIS) or through the use of a
command-line tool. When a WCF service is hosted under IIS and need HTTP or HTTPS settings
can be configured within IIS (using the inetmgr.exe tool). If a WCF service is self-hosted, HTTP

or HTTPS settings are configured by using a command-line tool. The tool used to configure
HTTP settings depends on the operating system the computer is running.

When running

Windows Server 2003 or Windows XP, use the HttpCfg.exe tool. Windows Server 2003
automatically installs this tool. When running Windows Vista or Windows 7, you configure these
settings with the Netsh.exe tool.
2.6.2 Configuring SSL Certificates
The Secure Sockets Layer (SSL) protocol uses certificates on the client and server to
store encryption keys. The server provides its SSL certificate when a connection is made so that
the client can verify the server identity. The server can also request a certificate from the client to
provide mutual authentication of both sides of the connection. Certificates are stored in a
centralized store according to the IP address and port number of the connection. The special IP
address 0.0.0.0 matches any IP address for the local machine. Note that the certificate store does
not distinguish URLs based on the path. Services with the same IP address and port combination
must share certificates even if the path in the URL for the services is different.
2.6.3 Configuring Namespace Reservations
Namespace reservation assigns the rights for a portion of the HTTP URL namespace
to a particular group of users. A reservation gives those users the right to create services that
listen on that portion of the namespace. Reservations are URL prefixes, meaning that the
reservation covers all sub-paths of the reservation path. Namespace reservations permit two ways
to use wildcards. The HTTP Server API documentation describes the order of resolution between
namespace claims that involve wildcards. A running application can create a similar request to
add namespace registrations. Registrations and reservations compete for portions of the
namespace. A reservation may have precedence over a registration according to the order of
resolution given in the order of resolution between namespace claims that involve wildcards. In
this case, the reservation blocks the running application from receiving requests. Running
Windows Vista, Windows Server 2008 R2 or Windows 7 If you are running on Windows Vista,
Windows Server 2008 R2 or Windows 7, use the Netsh.exe tool. The following shows an
example of using this command.
This command adds an URL reservation for the specified URL namespace for the
DOMAIN\user account. For more information on using the nets command type nest http add

oracle in a command-prompt and press enter. nest http add oracle url=http://+:80/MyUri
user=DOMAIN\user
2.6.4 Configuring the IP Listen List
The HTTP Server API only binds to an IP address and port once a user registers a URL.
By default, the HTTP Server API binds to the port in the URL for all of the IP addresses of the
machine. A conflict arises if an application that does not use the HTTP Server API has previously
bound to that combination of IP address and port. The IP Listen List allows WCF services to
coexist with applications that use a port for some of the IP addresses of the machine. If the IP
Listen List contains any entries, the HTTP Server API only binds to those IP addresses that the
list specifies. Modifying the IP Listen List requires administrative privileges.

4. SYSTEM TESTING

Introduction:
The process of performing a variety of tests on a system to explore functionality or to
identify problems. System testing is usually required before and after a system is put in place.
A series of systematic procedures are referred to while testing is being performed. These
procedures tell the tester how the system should perform and where common mistakes may be
found. Testers usually try to "break the system" by entering data that may cause the system to
malfunction or return incorrect information. For example, a tester may put in a city in a search
engine designed to only accept states, to see how the system will respond to the incorrect input.
System testing of software or hardware is testing conducted on a complete, integrated
system to evaluate the system's compliance with its specified requirements. System testing falls
within the scope of black box testing, and as such, should require no knowledge of the inner
design of the code or logic.
As a rule, system testing takes, as its input, all of the "integrated" software components that have
passed integration testing and also the software system itself integrated with any applicable
hardware system(s). The purpose of integration testing is to detect any inconsistencies between
the software units that are integrated together (called assemblages) or between any of
the assemblages and the hardware. System testing is a more limited type of testing; it seeks to
detect defects both within the "inter-assemblages" and also within the system as a whole.
System Testing (ST) is a black box testing technique performed to evaluate the
complete system the system's compliance against specified requirements. In System testing, the
functionalities of the system are tested from an end-to-end perspective.System Testing is usually
carried out by a team that is independent of the development team in order to measure the quality
of the system unbiased. It includes both functional and Non-Functional testing.

Steps for system test:

In system testing the behavior of whole system/product is tested as defined by the scope
of the development project or product.

It may include tests based on risks and/or requirement specifications, business process,
use cases, or other high level descriptions of system behavior, interactions with the
operating systems, and system resources.

System testing is most often the final test to verify that the system to be delivered meets
the specification and its purpose.

System testing is carried out by specialists testers or independent testers.

System testing should investigate both functional and non-functional requirements of the
testing.

Types of System Tests:

Testing is a process used to help identify the correctness, completeness and quality of
developed computer software. With that in mind, testing can never completely establish the
correctness of computer software.

As a rule, system testing takes, as its input, all of the "integrated" software components
that have successfully passed integration testing and also the software system itself integrated
with any applicable hardware system(s). The purpose of integration testing is to detect any
inconsistencies between the software units that are integrated together (called assemblages) or
between any of the assemblages and the hardware. System testing is a more limiting type of
testing; it seeks to detect defects both within the "inter-assemblages" and also within the system
as a whole.

Testing Methodologies:
System testing is the state of implementation, which is aimed at ensuring that the system
works accurately and efficiently as expect before live operation commences. It certifies that the
whole set of programs hang together. System testing requires a test plan that consists of several
key activities and steps for run program, string, system and user acceptance testing. The
implementation of newly designed package is important in adopting a successful new system.
Testing is an important stage in software development. The system test in implementation
stage in software development. The system test in implementation should be confirmation that
all is correct and an opportunity to show the users that the system works as expected. It
accounts the largest percentage of technical effort in the software development process.
Testing phase in the development cycle validates the code against the functional
specification. Testing is vital to the achievement of the system goals. The objective of testing is
to discover errors. To fulfill this objective a series of test step unit, integration, validations and
system tests were planned and executed.

UNIT TESTING
When the programs have been coded and compiled and brought to working conditions,
they must be individually tested with the prepared test data. Any undesirable happening must be
noted and debugged (error corrections).

INTEGRATION TESTING
Integration testing is the phase of software testing in which individual software modules
are combined and tested as a group. It follows unit testing and precedes system testing.
Integration testing takes as its input modules that have been unit tested, groups them in
larger aggregates, applies tests defined in an integration test plan to those aggregates, and
delivers as its output the integrated system ready for system testing.

BLACK BOX TESTING

Black box testing takes an external perspective of the test object to derive test cases.
These tests can be functional or non-functional, though usually functional. The test designer
selects valid and invalid input and determines the correct output. There is no knowledge of the
test object's internal structure.
WHITE BOX TESTING
White box uses an internal perspective of the system to design test cases based on
internal structure. It requires programming skills to identify all paths through the software.
The tester chooses test case inputs to exercise paths through the code and determines the
appropriate outputs.
The logical flow of a program is sometimes counter intuitive, meaning that unconscious
assumptions about flow of control and data may lead to make design errors that are uncovered
only once path testing commences.

While white box testing is applicable at the unit, integration and system levels of the
software testing process, it is typically applied to the unit. While it normally tests paths within a
unit, it can also test paths between units during integration, and between subsystems during a
system level test.

VALIDATION TESTING
Validation testing provides the final assurance that software meets all functional,
behavioural and performance requirements. Validation testing can be defined in many ways, but
a simple definition is that validations succeed when the software functions in a manner that is
expected by the user. The software once validated must be combined with other system element.
System testing verifies that all elements combine properly and that overall system function and
performance is achieved. After the integration of the modules, the validation test was carried out
over by the system. It was found that all the modules work well together and meet the overall
system function and performance. According to this testing marketing is error free.

5. SYSTEM IMPLEMENTATION
5.1 STEPS OF IMPLEMENTATION
The simplest security mechanisms were designed to ensure the integrity of
data transmitted between devices (e.g., computers and terminals).

When devices

communicate over a noisy channel, such as a phone line, there was a possibility that
data might be altered.

To guard against this, systems would transmit an extra bit, the parity

bit, for each byte of data. The value of the extra bit was chosen to ensure that the number of 1s
in the nine bits were odd (odd parity) or even (even parity). If the parity was wrong, data had
been altered, and should be rejected.

This mechanism is frequently used with modem

connections. Parity bits are arelatively expensive form of integrity protection. They increase the
size of the message by at least 12.5%. Worse, they may not detect multiple errors in the same

byte. While this mechanism can be extended to detect such errors by using additional parity bits,
the cost is increased yet again.
5.2 DIGITIZED SIGNATURE
In the paper world, the traditional mechanism for non-repudiation is the handwritten
signature. This signature indicates that the signer has written, approved, or acknowledged the
contents of the paper document.

A digitized signature is sometimes used as a substitute

for written signatures when applications are computerized. A digitized signature is created by
scanning in a handwritten signature. When someone wishes to sign an electronic document,
they simply insert the image of their signature where appropriate.

When the receiver

views an electronic document or message, they immediately recognize the meaning of the
digitized signature. Digitized signatures are one of the easiest mechanisms to use. If Bob knows
Alices signature, the will recognize it right away. Digitized signatures should not be relied upon
for any security services. Digitized signatures are generally used in conjunction with a stronger
mechanism to add usability.
5.3 PINs AND PASSWORDS
The traditional method for authenticating users has been to provide them with a
personal identification number or secret password, which they must use when requesting
access to a particular system.
they seldom are.

Password systems can be effective if managed properly, but

Authentication that relies solely on passwords has often failed to

provide adequate protection for computer systems for a number of reasons. If users are allowed
to make up their own passwords, they tend to choose ones that are easy to remember and
therefore easy to guess. If passwords are generated from a random combination of characters,
users often write them down because they are difficult to remember. Where password-only
authentication is not adequate for an application, it is often used in combination with other
security mechanisms. PINs and passwords do not provide non-repudiation, confidentiality, or
integrity. If Alice wishes to authenticate to Bob using a password, Bob must also know it. Since
both Alice and Bob know the password, it is difficult to prove which of them performed a
particular operation.
5.4 FIREWALL SOFTWARE
A firewall is simply a program or hardware device that filters the information coming

through the Internet connection into private network .If an incoming packet of information is
flagged by the filters, it is not allowed through. The company will therefore have hundreds of
computers that all have network cards connecting them together. In addition, the company will
have one or more connections to the Internet through something like T1 or T3 lines. Without a
firewall in place, all of those hundreds of computers are directly accessible to anyone on the
Internet. A person who knows what he or she is doing can probe those computers, try to make
FTP connections to them, try to make telnet connections to them and so on. If one employee
makes a mistake and leaves a security hole, hackers can get to the machine and exploit the hole.
Firewalls use one or more of three methods to control traffic flowing in and out of the network:
Packet filtering - Packets (small chunks of data) are analyzed against a set of filters. Packets
that make it through the filters are sent to the requesting system and all others are discarded.
Proxy service - Information from the Internet is retrieved by the firewall and then sent
to the requesting system and vice versa.
State ful inspection - A newer method that doesn't examine the contents of each packet but
instead compares certain key parts of the packet to a database of trusted information. Information
traveling from inside the firewall to the outside is monitored for specific defining characteristics,
then incoming information is compared to these characteristics. If the comparison yields a
reasonable match, the information is allowed through. Otherwise it is discarded.
5.5 FIREWALL CONFIGURATION
Firewalls are customizable. This means that you can add or remove filters based on
several conditions. Some of these are: IP addresses Each machine on the Internet is assigned a
unique address called an IP address. IP addresses are 32-bit numbers, normally expressed as four
"octets" in a "dotted decimal number." A typical IP address looks like this: 216.27.61.137. For
example, if a certain IP address outside the company is reading too many files from a server, the
firewall can block all traffic to or from that IP address. Domain names - Because it is hard to
remember the string of numbers that make up an IP address, and because IP addresses sometimes
need to change, all servers on the Internet also have human-readable names, called domain
names. For example, it is easier for most of us to remember www.howstuffworks.com than it is
to remember 216.27.61.137. A company might block all access to certain domain names, or
allow access only to specific domain names. Protocols - The protocol is the pre-defined way that

someone who wants to use a service talks with that service. The "someone" could be a person,
but more often it is a computer program like a Web browser. Protocols are often text, and simply
describe how the client and server will have their conversation. The http in the Web's protocol.
Some common protocols that you can set firewall filters for include:
IP (Internet Protocol) - the main delivery system for information over the Internet
TCP (Transmission Control Protocol) - used to break apart and rebuild information that travels
over the Internet
HTTP (Hyper Text Transfer Protocol) - used for Web pages
FTP (File Transfer Protocol) - used to download and upload files
28
UDP (User Datagram Protocol) - used for information that requires no response, such as
streaming audio and video
ICMP (Internet Control Message Protocol) - used by a router to exchange the information with
other routers
SMTP (Simple Mail Transport Protocol) - used to send text-based information (e-mail)
SNMP (Simple Network Management Protocol) - used to collect system information from a
remote computer
Telnet - used to perform commands on a remote computer
A company might set up only one or two machines to handle a specific protocol and ban
that protocol on all other machines.
Ports - Any server machine makes its services available to the Internet using numbered ports,
one for each service that is available on the server. For example, if a server machine is running a
Web (HTTP) server and an FTP server, the Web server would typically be available on port 80,
and the FTP server would be available on port 21. A company might block port 21 access on all
machines but one inside the company.
Specific words and phrases - This can be anything. The firewall will sniff (search through) each
packet of information for an exact match of the text listed in the filter. For example, you could
instruct the firewall to block any packet with the word "X-rated" in it. The key here is that it has
to be an exact match. The "X-rated" filter would not catch "X rated" (no hyphen). But you can
include as many words, phrases and variations of them as you need.
Some operating systems come with a firewall built in. Otherwise, a software firewall
can be installed on the computer in your home that has an Internet connection. This computer is
considered a gateway because it provides the only point of access between your home network

and the Internet. With a hardware firewall, the firewall unit itself is normally the gateway. A
good example is the Linksys Cable/DSL router. It has a built-in Ethernet card and hub.
Computers in your home network connect to the router, which in turn is connected to either a
cable or DSL modem. You configure the router via a Web-based interface that you reach through
the browser on your computer. You can then set any filters or additional information. Hardware
firewalls are incredibly secure and not very expensive. Home versions that include a router,
firewall and Ethernet hub for broadband connections can be found for well under $100.
5.6 FIREWALL SECURITY
There are many creative ways that unscrupulous people use to access or abuse unprotected
computers:
Remote login - When someone is able to connect to your computer and control it in some form.
This can range from being able to view or access your files to actually running programs on your
computer.
Application backdoors - Some programs have special features that allow for remote access.
Others contain bugs that provide a backdoor, or hidden access, that provides some level of
control of the program.
SMTP session hijacking - SMTP is the most common method of sending e-mail over the
Internet. By gaining access to a list of e-mail addresses, a person can send unsolicited junk email (spam) thousands of users. This is done quite often by redirecting the e-mail through the
SMTP server of an unsuspecting host, making the actual sender of the spam difficult to trace.
Operating system bugs - Like applications, some operating systems have backdoors. Others
provide remote access with insufficient security controls or have bugs that an experienced hacker
can take advantage of.
Denial of service - You have probably heard this phrase used in news reports on the attacks on
major Web sites. This type of attack is nearly impossible to counter. What happens is that the
hacker sends a request to the server to connect to it. When the server responds with an
acknowledgement and tries to establish a session, it cannot find the system that made the request.
By inundating a server with these unanswerable session requests, a hacker causes the server to
slow to a crawl or eventually crash.
E-mail bombs - An e-mail bomb is usually a personal attack. Someone sends you the same e-

mail hundreds or thousands of times until your e-mail system cannot accept any more messages.
Macros - To simplify complicated procedures, many applications allow you to create a script of
commands that the application can run. This script is known as a macro. Hackers have taken
advantage of this to create their own macros that, depending on the application, can destroy your
data or crash your computer. Viruses - Probably the most well-known threat is computer viruses.
A virus is a small program that can copy itself to other computers. This way it can spread quickly
from one system to the next. Viruses range from harmless messages to erasing all of your data.
Spam - Typically harmless but always annoying, spam is the electronic equivalent of junk mail.
Spam can be dangerous though. Quite often it contains links to Web sites. Be careful of clicking
on these because you may accidentally accept a cookie that provides a backdoor to your
computer.
Redirect bombs - Hackers can use ICMP to change (redirect) the path information takes by
sending it to a different router. This is one of the ways that a denial of service attack is set up.
Source routing - In most cases, the path a packet travels over the Internet (or any other network)
is determined by the routers along that path. But the source providing the packet can arbitrarily
specify the route that the packet should travel. Hackers sometimes take advantage of this to make
information appear to come from a trusted source or even from inside the network! Most firewall
products disable source routing by default.
Some of the items in the list above are hard, if not impossible, to filter using a firewall. While
some firewalls offer virus protection, it is worth the investment to install anti-virus software on
each computer. And, even though it is annoying, some spam is going to get through your firewall
as long as you accept e-mail.
The level of security you establish will determine how many of these threats can be
stopped by your firewall. The highest level of security would be to simply block everything.
Obviously that defeats the purpose of having an Internet connection. But a common rule of
thumb is to block everything, then begin to select what types of traffic you will allow. You can
also restrict traffic that travels through the firewall so that only certain types of information, such
as e-mail, can get through. This is a good rule for businesses that have an experienced network
administrator that understands what the needs are and knows exactly what traffic to allow
through. For most of us, it is probably better to work with the defaults provided by the firewall

developer unless there is a specific reason to change it.

One of the best things about a firewall from a security standpoint is that it stops anyone
on the outside from logging onto a computer in your private network. While this is a big deal for
businesses, most home networks will probably not be threatened in this manner. Still, putting a
firewall in place provides some peace of mind.
Installing the Terminal Services ActiveX Client
Download

the

component

from

Microsoft's

website

located

at

microsoft.com/windows xp/downloads/tools/rdwebconn.mspx. On the right side of

the screen, select your language and press the "Go" button. Click the "Install" button
when prompted.
Select a directory for the location of the files. A window prompts you for a directory
path by asking "Where would you like to place the sample web page directory?" For
this example, enter "C:\Windows\Web\TSWeb." Click the "OK" button.
Click the "Yes" button when the application prompts you to create the new directory.
Verify the application was installed by clicking the Windows "Start" button, select
"Settings" and choose "Control Panel" from the menu.
Double-click the "Add/Remove Programs" icon. In the installed list of applications,
Terminal Services (Remote Desktop for Windows XP users) should be in the list of
programs.
Enabling Terminal Services in ActiveX
The Terminal Services Web Client is an ActiveX control that is also known as the Remote
Desktop Web Connection control. The service control allows you to access a computer from
another computer using the Internet. The Terminal Services ActiveX control is available as a free
download provided by Microsoft. Before installing the control on your computer you should
make sure that you have administrator privileges to download and install the file.
Download the Terminal Services ActiveX control from the Microsoft website.
Select the language you want to work with from the drop-down menu then click the
"Go" button. Click the "I agree" option from the License Agreement page.
Click the "Save this program to disk" option from the File Download. Select
a folder on your computer to save the program then click the "Save" button.
Locate the folder you selected to save the file in then double-click on the file
Enter "C:\Windows\Web\TSWeb" into the text box that appears then click the "OK"
button. Click on the "Yes" button if you are prompted to create the TSWeb folder. The

Terminal Services will then be activated on your computer.

6.7 CONVERTING DLL TO ACTIVEX
Computer programmers combine several components and references to create a program.
An ActiveX control is a unit of code that you can reuse easily. This helps make common
functionality consistent and saves coding time. You can reference or code one or more dlls into
an ActiveX component. ActiveX components are visual or no visual. However, the no visual
ActiveX components that you download from the Internet could have potentially dangerous code
in them.
6.7.1

Instructions
Start a new Visual Basic project by opening "Visual Basic" and selecting "File," "New

Project." Select "ActiveX Control" from the "New Project" window. This will create a new,
blank control called "UserControl1." You are free to rename the control whatever you like Begin
adding code to the new ActiveX project. If you have a dll that you have already coded, begin
moving the classes from that program into new classes in the ActiveX project. If you are going to
be combining functionality with one or more dlls into this project, go to the menu and select
"Project," "References." Scroll through the available references until you locate the dll that you
are searching for and click the check box next to it. Click "OK" to save the dll as a reference in
this project. Make your ocx control by selecting "File," "Make" from the menu. Next to "Make"
will be the name of the project. This will also be the name of your ActiveX ocx control. If your
project is named "My Project," your control will be "MyProject.ocx." After you select "Make,"
you can change the name of the ocx file in the "Make Project" window that opens next.
Add your ActiveX control to your new project by selecting "Project," "Components"
from the menu. Locate the name of the ocx file that you just created, and click the check box
next to it. Click "OK" to save your changes. You will see the ActiveX control show up in your
"Toolbox" window if you have that window open. You may now add this control to your form
and reuse this same control in other programs. Firewalls: Basic
5.7.2 Approaches and Limitations
Firewall technology can be used to protect networks, by installing it strategically at a
single security screen station where the private network or the Intranet connects to the public
Internet, making it easier to ensure security, audit and monitor traffic, and trace break-in

attempts. It can also be used to isolate sub-networks, in order to provide additional layers of
security (defence-in-depth) within the organisation. There are three basic approaches or services
that a firewall uses to protect a network: packet filtering, circuit proxy, and application proxy .
Some authors broadly classify these into two kinds of approach: transport level and application
level (by including circuit proxy in this category).
5.7.3 Packet filtering
Firewalls having this function perform only very basic operations, such as examining
the packet header, verifying the IP address, the port or both, and granting and denying access
without making any changes. Due to this simplicity of operation, they have the advantage of both
speed and efficiency. The filtered packets may be incoming, outgoing or both, depending on the
type of router. An additional advantage is that they do their job quiet independently of the user's
knowledge or assistance, i.e., they have good transparency. Packets can be filtered on the basis of
some or all of the following criteria: source IP address, destination IP address,TCP/UDP source
port, and TCP/UDP destination port. A firewall of this type can block connections to and from
specific hosts, networks and ports. They are cheap since they use software already resident in the
router, and provide a good level of security since they are placed strategically at the choke point.
5.7.4 Circuit Proxy
The second approach is the use of what is called a circuit proxy. The main difference
between the circuit proxy and the packet filtering firewall is that the former is the addressee to
which all communicators must address their packets. Assuming access has been granted, the
circuit proxy replaces the original address (its own) with the address of the intended destination.
It has the disadvantage of laying claim to the processing resources required to make changes to
the header, and the advantage of concealing the IP address of the target system.
5.7.5 Application Proxy
The third approach involves the use of what is known as an application proxy. An
application proxy is more complicated in operation than a packet filtering firewall or a circuit
proxy. The application proxy understands the application protocol and data, and intercepts any
information intended for that application. On the basis of the amount of information available to
make decisions, the application proxy can authenticate users and judge whether any of the data
could pose a threat. The price to be paid for this more comprehensive function is that users or
clients often have to be reconfigured to them, sometimes a complicated process, with a

consequent loss of transparency. Application proxies are referred to as proxy services, and the
host machines running them as application gateways.
5.7.6 Packet Inspection Approach
This approach, in contrast to the technologies so far described, involves inspecting the
contents of packets as wells as their headers. An inspection firewall carries out its inspection by
using an inspection module, which understands, and can therefore inspect, data destined for all
layers (from network layer to application layer). It carries out its inspection by integrating all
information gathered from all layers into a single inspection point, and then examining it. A
state-full inspection firewall is one which also registers the state of any connection it is handling,
and acts on this information. An example of a state-full inspection firewall is the state-full
packet-filtering mode in Checkpoint's Firewall-1or Network Associates' Gauntlet. Inspection
firewalls can provide address translation and hiding, virus scanning, Web site filtering, screening
for key words (typically in e-mail), and context-sensitive security for complex applications.
5.7.7 Content Caching
While caching is not traditionally a function of firewalls, it is becoming an
increasingly frequent and important feature. An increase in performance is achieved by caching
the contents of an accessed location with the result that subsequent requests for access will lead
to already cached contents being used, without it being necessary to access the location again
(except when it is necessary to refresh).
5.7.8 Logging and Alerts
It is important for a firewall to log events, determine their legitimacy or otherwise, and
notify the network administrator. It should be noted that it is essential to protect the integrity of
the log, since unauthorized access to, and editing of, the log will, of course, neutralize its raison
dtre. Whether the function of protecting the log is fulfilled by the firewall itself or not, is a
matter of implementation.
Cryptography notwithstanding, the use of firewalls is deeply entrenched in a number of
organizations and is part and parcel of their security set up, and will continue to be so for some
years yet. While it is true that cryptography is the heir apparent to the firewall, the number of as
yet unresolved issues prevents the assembling of a comprehensive solution for securing
distributed computing resources around Public Key Infrastructure (PKI) and encryption. In
addition, the process of standardization within the area of PKI is not proceeding particularly

rapidly. Thus, even those organizations favouring technologies other than firewalls will just have
to bite the bullet and live with them for the moment. Another factor is the ongoing development
of new features and services at present being continually added to firewalls. These reduce a
number of the limitations listed above and increase the firewall's flexibility while allowing it to
retain its original function unimpaired. Examples, to mention but a few, that illustrate this point
are:The proposal of a distributed firewall , using IPSEC (IP Security), a policy language, and
system management tools, that preserves central control of access policy while reducing or
eliminating any dependency on topology Phoenix's Adaptive Firewall Technology , as noted
above, provides self-adapting control of network access, thus establishing an effective network
security policy by examining every packet and adapting rules "on-the-fly" based on information
in the packet passing through the network interface FORE Systems' Firewall Switching Agent ,
in combination with Check Point's. Firewall, provides 20 Gbps of firewall switching bandwidth
while delivering wire-speed routing, switching, and class-of-service delivery. OMG's CORBA
Firewall Security , which brings firewalls to distributed object technology and provides a
standard approach by which a firewall identifies and controls the flow of IIOP (Internet InterORB Protocol), which has become the defects standard interoperability protocol for Internet,
providing "out-of-the-box" interoperation with ORBs (Object Request Brokers), thereby
increasing the security of CORBA-based applications.
These trends in the development of firewalls make them important mechanisms to ease the
transition to flexible and truly distributed security solutions, such as CORBA Security Services,
thus sparing traditionally-minded network/firewall administrators much discomfort. After all, the
laboratory test results described in "Super firewalls" show that today's high-end firewalls are
tougher, faster, and easier to use.
5.7.9 Guide to Setting up Internet Connection Sharing for Windows
Installation of Internet Connection Sharing and Configuration.The First step to setting
up ICS is to configure the Host, i.e. the computer with the Internet connection that will be share,
all the Other Computers in the network need to be configured as Clients which will explain in
next sub title. Host Configuration on Windows XP / Windows Server 2003
Double click on the Network and Dial up connections icon in Control Panel or right click
on the My Network Places desktop icon and select Properties. Here, you should have at least
two connections listed: one for your internet connection, and one for your Local area

connection. Among the installed components listed in the general tab the following should be
checked here.
Client for Microsoft Networks
Internet Protocol (TCP/IP)
If there are extra entries just ignore them and click OK button. Now right click on the
entry corresponding to your Internet Connection, and select properties . Go to the
Advanced tab and choose Internet Connection Sharing option,
and turn on the enable Internet Connection sharing for this Connection option.
You will get IP address changing indication message like shown below, click on yes,
and change the IP address manually to your previous static IP (Note down your Previous IP
address before doing the last step).
You can change your IP by right clicking on My networking place
icon in Desktop and select properties, then right click on Local area connection and select
properties, go to Networking tab, select Internet Protocol TCP/IP, click on Properties and enter
the IP address, click on ok., Now Your Server side configuration is completed.
5.8 Different Versions of IIS
5.8.1 Using ASP.NET MVC with Different Versions of IIS (C#)
The ASP.NET MVC framework depends on ASP.NET Routing to route browser
requests to controller actions. In order to take advantage of ASP.NET Routing, you might have to
perform additional configuration steps on your web server. It all depends on the version of
Internet Information Services (IIS) and the request processing mode for your application. Heres
a summary of the different versions of IIS: IIS 7.0 (integrated mode) - No special configuration
necessary to use ASP.NET Routing .IIS 7.0 (classic mode) - You need to perform special
configuration to use ASP.NET Routing .IIS 6.0 or below - You need to perform special
configuration to use ASP.NET Routing. The latest version of IIS is version 7.5 (on Win7). IIS 7
of IIS is included with Windows Server 2008 AND VISTA/SP1 and higher. You also can install
IIS 7.0 on any version of the Vista operating system except Home Basic IIS 7.0 supports two
modes for processing requests. You can use integrated mode or classic mode. You don't need to
perform any special configuration steps when using IIS 7.0 in integrated mode. However, you do
need to perform additional configuration when using IIS 7.0 in classic mode. Microsoft Windows

Server 2003 includes IIS 6.0. You cannot upgrade IIS 6.0 to IIS 7.0 when using the Windows
Server 2003 operating system. You must perform additional configuration steps when using IIS
6.0.Microsoft Windows XP Professional includes IIS 5.1. You must perform additional
configuration steps when using IIS 5.1. Finally, Microsoft Windows 2000 and Microsoft
Windows 2000 Professional includes IIS 5.0. You must perform additional configuration steps
when using IIS 5.0.
5.8.2 Integrated versus Classic Mode
IIS 7.0 can process requests using two different request processing modes: integrated
and classic. Integrated mode provides better performance and more features. Classic mode is
included for backwards compatibility with earlier versions of IIS. The request processing mode
is determined by the application pool. You can determine which processing mode is being used
by a particular web application by determining the application pool associated with the
application. Follow these steps: Launch the Internet Information Services Manager. In the
Connections window, select an application .In the Actions window, click the Basic Settings link
to open the Edit Application dialog box .Take note of the Application pool selected. By default,
IIS is configured to support two application pools: Default App Pool and Classic .NET App Pool.
If Default App Pool is selected, then your application is running in integrated request processing
mode. If Classic .NET App Pool is selected, your application is running in classic request
processing mode.
5.8.3 Using ASP.NET MVC with Older Versions of IIS
If you need to use ASP.NET MVC with an older version of IIS than IIS 7.0, or you need
to use IIS 7.0 in classic mode, then you have two options. First, you can modify the route table to
use file extensions. For example, instead of requesting a URL like /Store/Details, you would
request a URL like /Store.aspx/Details. The second option is to create something called a
wildcard script map. A wildcard script map enables you to map every request into the ASP.NET
framework.
5.8.4 IIS configuration
This section deals with deploying Code striker under IIS, as a CGI script. At the time of
writing, the current version of Active Perl (5.8.8.817) contains a version of CGI.pm which is
broken for IIS deployments. These instructions were performed on a Windows 2000 machine, so

hopefully this provides an indication as to what needs to be performed for other Win32
configurations. Startup the IIS configuration application by going to "Control Panel" ->
"Administrative Tools" -> "Internet Services Manager". Like the Apache configuration, the web
server needs to be told where to find the Code striker CGI script, and where to find the
associated CSS and html help files. Assuming you are deploying Code striker under the "Default
Web site", right-click this entry on the left hand frame of the window, and select "New" ->
"Virtual Directory" -> "Next". Enter in code striker into the Alias text field, then click "Next".
Then enter the cgi-bin directory of your unpacked Code striker distribution into the "Directory"
text field, then
click "Next". Make sure the "Execute" access permission checkbox is selected, then click
"Next, click then "Finished". It is important that the code striker virtual directory is setup to be
able to execute Perl scripts. Right-click the code striker virtual directory and select "Properties".
Click on the "Configuration..." button. Check that there is an entry for .pl files, and that the
"Executable Path" entry looks like (substitute the path to your local Perl installation):
C:\Perl\bin\perl.exe "%s" %s. If there is no mapping for .pl files (which would be odd, since the
Active State install does this for you automatically), add a new entry in with the above setting,
limited to "GET,HEAD,POST". Make sure you enter the quotes, as shown above. Follow a
similar process for the code striker html directory. Right-click "Default Web site" and select
"New" -> "Virtual Directory" -> "Next". Enter in code striker html into the Alias text field, then
click "Next". Then enter the html directory of your unpacked Code striker distribution into the
"Directory" text field, then click "Next". Make sure the "Read" and "Browse" access permission
checkboxes are selected, then "Next", then "Finished".
Ensure the security for the two virtual directories code striker and code striker html are
appropriate for your site. Right-click on each directory, and select "Properties", then the
"Directory Security" tab. Click the "Edit..." button and make the appropriate changes for your
deployment. Right-click "Default Web site" and select "Start" if the website is not currently
running, and test it.

6. SCOPE OF FUTURE ENHANCEMENT

In this project, we presented The MULET algorithm which uses a direct mapping
technique which apart from being simple in implementation also has a reduced run time

complexity. The ability of the proposed algorithm to work over different language domains
will facilitate the localization of Cryptographic Software tools. We have also seen that the
algorithm is immune to intruders. The robustness of this encryption method is attributed to the
multiple facets of the algorithm. Further studies will concentrate on enhancing the replacement
strategy so as to incorporate data compression thereby catering to the present day needs of
reduced network traffic.

7. BIBLIOGRAPHY
1. Ross J. Anderson, Why Cryptosystems Fail, Communications of the ACM, New York,
USA, 1994, pp. 32-40.
2. Francois-Xavier Standaert, Gilles Piret, Jean-Jacques Quisquater,
Cryptanalysis of Block Ciphers: A Survey, UCL Crypto Group, 2003.
3. R.L. Rivest, The RC5 encryption algorithm, Proceedings of the 1994 Leuven Workshop on
Fast Software Encryption, Springer-Verlag, 1995, pp. 86-96.
4. William C. Barker, Recommendation for the Triple Data Encryption Algorithm (TDEA)
Block Cipher, National Institute of Standards and Technology, NIST Special Publication 80067, 2008.
5. Collins, R.W., Software localization for Internet software, issues and methods, Software,
IEEE, Florida, USA, 2002, pp. 74-80.

6. Elliptic Curve Cryptography, Certicom Research, 2000

7. Unicode Character form http://www.unicode.org

8. ANNEXURE

A.DATAFLOW DIAGRAMS

C1 SAMPLE CODING
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
namespace ClientApp
{
public partial class frmLogin : Form
{
public frmLogin()
{
InitializeComponent();
}
private void frmLogin_Load(object sender, EventArgs e)
{
}
private void btnClose_Click(object sender, EventArgs e)
{
Application.Exit();
}
private void btnNew_Click(object sender, EventArgs e)
{
frmNew Obj = new frmNew();
Obj.Show();
Hide();
//Close();

}
private void btnLogin_Click(object sender, EventArgs e)
{
string UN,PW,Stat;
UN = txtEMail.Text;
PW = txtPassword.Text;
txtEMail.Enabled = false;
txtPassword.Enabled = false;
if (UN != "" || PW != "")
{
if (UN.Contains("@") || UN.Contains("."))
{
srvWebApp.SWebService Logi = new

ClientApp.srvWebApp.SWebService();

Stat = Logi.LoginCheck(UN, PW).ToString();

//MessageBox.Show(Stat);
if (Stat == "Login Succeeded")
{
Hide();
frmMain opn = new frmMain(UN);
opn.Show();
ClearFields();
//frmLogin.ActiveForm.Dispose();
//this.Close();
}
}
else
{
MessageBox.Show("Invalid E-Mail ID");
}
}

else
{
MessageBox.Show("The UserName & Password Cannot be Empty");
}
txtEMail.Enabled = true;
txtPassword.Enabled = true;
}
private void linkLabel1_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e)
{
//frmPwd opn = new frmPwd();
//opn.Show();
}
private void ClearFields()
{
txtPassword.Text = "";
txtEMail.Text = "";
}
}
}
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.IO;
namespace ClientApp
{
public partial class frmMain : Form

{
string UserNm, Password, PinNo, Sender, Receiver, O_PinNo;
byte Enc_Lang_;
string Current_Date_Time, Last_Date_Time;
string Rcv_List;
string Tag_Info;
string GlobalPwd = "r.navaneeth@live.com, navaneethkrish@live.in";
string File_ID = "";
public frmMain(string Msg)
{
InitializeComponent();
UserNm = Msg;
}
private void Form1_Load(object sender, EventArgs e)
{
Resize_Window();
NewDoc();
//txtStatus.Text = "Log in Success " + UserNm + "\n" + txtStatus.Text;
Update_Status("Log in Success " + UserNm);
}
private void richTextBox1_TextChanged(object sender, EventArgs e)
{
}
private void Form1_Closd(object sender, EventArgs e)
{
//Close();
Application.Exit();
}

private void frm_Resiz(object sender, EventArgs e)

{
Resize_Window();
}
private void Resize_Window()
{
pnlToolBar.Width = this.Width;
txt.Width = this.Width - 215;
grpOptions.Left = txt.Width + 4;
grpOptions.Top = txt.Top;
grpTask.Top = this.Height - 140;
grpTask.Width = this.Width - 10;
txtStatus.Width = grpTask.Width - 10;
txt.Height = this.Height - grpTask.Height - pnlToolBar.Height - 45;
grpOptions.Height = txt.Height;
}
private void btnNew_Click(object sender, EventArgs e)
{
_NewDoc();
Update_Status("New Document");
}
private void Update_Status(string _Msg)
{
txtStatus.Text = DateTime.Now +" "+ _Msg + "\n" + txtStatus.Text;
}
private void grpTask_Enter(object sender, EventArgs e)
{

}
private void btnOpen_Click(object sender, EventArgs e)
{
string path;
int CharLen;
string Char_Data;
string[] Split_Str = null;
OpenFileDialog opn = new OpenFileDialog();
opn.Filter = "Encrypted Data File(*.encdf)|*.encdf|Text Files(*.txt)|*.txt|All files (*.*)|*.*";
if ((opn.ShowDialog()) == (DialogResult.OK))
{
path = opn.FileName;
_NewDoc();
//txt.Text = File.ReadAllText(path);
Char_Data = File.ReadAllText(path);
if (Char_Data.StartsWith("$SYS!=0"))
{
Split_Str = Char_Data.Split((char)12345);
Char_Data = Split_Str[1];
Tag_Info = Split_Str[0].Substring(7, Split_Str[0].Length - 7);
//ms
txt.Text = Char_Data;
Read_MetaData(Tag_Info);
txtFileID.Text = File_ID;
btnEncrypt.Enabled = false;
groupBox1.Enabled = false;
Update_Status("File Open " + path + " Encrypted Data File");
}

else
{
using (FileStream fsSource = new FileStream(path, FileMode.Open, FileAccess.Read))
{
CharLen = (int)fsSource.Length;
byte[] bytes = new byte[CharLen];
int numBytesToRead = CharLen;
int numBytesRead = 0;
while (numBytesToRead > 0)
{
int n = fsSource.Read(bytes, numBytesRead, numBytesToRead);
if (n == 0)
break;
numBytesRead += n;
numBytesToRead -= n;
}
txt.Text = System.Text.ASCIIEncoding.ASCII.GetString(bytes);
}
if (CharLen / 2 <= txt.TextLength)
{
Update_Status("File Open " + path + " Succeeded");
btnEncrypt.Enabled = true;
groupBox1.Enabled = true;
btnDecrypt.Enabled = false;
}
else
{
_NewDoc();
Update_Status("File Open " + path + " Failed(Unsupported File Format)");
}
}

}
else
{
Update_Status("File Open Aborted");
}
}
private void _NewDoc()
{
txt.Text = "";
File_ID = "";
txtFileID.Text = "";
btnSave.Enabled = false;
groupBox1.Enabled = true;
Password = "";
Sender = "";
PinNo = "";
O_PinNo = "";
Current_Date_Time = "";
Last_Date_Time = "";
Tag_Info = "";
Receiver = "";
Rcv_List = "";
txtDate.Text = "";
txtReceivers.Text = "";
txtSender.Text = "";
}
private void Select_Enc_Method()
{
if (rdbAra.Checked)
Enc_Lang_ = 1;

else if (rdbChi.Checked)
Enc_Lang_ = 3;
else if (rdbJap.Checked)
Enc_Lang_ = 6;
else if (rdbNum.Checked)
Enc_Lang_ = 7;
else if (rdbSym.Checked)
Enc_Lang_ = 8;
}
private void btnEncrypt_Click(object sender, EventArgs e)
{
if (txt.Text != "")
{
Select_Enc_Method();
frmPwd opnPwd = new frmPwd(this);
opnPwd.ShowDialog();
}
}
public void Do_Encp(string PassWd, string PnNo, string rcvList)
{
string OP = "";
Password = PassWd;
PinNo = PnNo;
Rcv_List = rcvList;
BaseEngine.clsEncDec Enc = new
BaseEngine.clsEncDec(Enc_Lang_);
OP = Enc.Encryption(txt.Text, Password);
txt.Text = OP;

btnDecrypt.Enabled = true;
btnEncrypt.Enabled = false;
btnSave.Enabled = true;
}
private string MakeTag()
{
string Out = "";
Current_Date_Time = DateTime.Now.ToString();
srvWebApp.SWebService GetNo = new
ClientApp.srvWebApp.SWebService();
File_ID = GetNo.AutoNumber();
Out = UserNm + "" + Rcv_List + "" + Current_Date_Time + "
+ PinNo + "" + Enc_Lang_ + "" + File_ID;
return Out;
}
private void btnSave_Click(object sender, EventArgs e)
{
string FPath;
string tmp="";
SaveFileDialog svFi = new SaveFileDialog();
svFi.Filter = "Encrypted Data File(*.encdf)|*.encdf";
Encp.Security encSav = new Encp.Security();
Tag_Info = MakeTag();
Encp.Security HideKey = new Encp.Security();
srvWebApp.SWebService AdInfo = new
ClietApp.srvWebApp.SWebService();
tmp = AdInfo.UpdateKey(File_ID, UserNm, Rcv_List,
HideKey.HEnc(ref Password));
if (tmp == "Success")

{
if (svFi.ShowDialog() == DialogResult.OK)
{
FPath = svFi.FileName;
File.WriteAllText(FPath, "$SYS!=0" + encSav.Encyrpt(ref
Tag_Info, ref GlobalPwd) + (char)12345 + txt.Text);
Update_Status("File Saved " + FPath + " As Encrypted Data
File");
Update_Status("File Information Successfully updated in the
server with File ID " + File_ID);
}
}
else
{
MessageBox.Show(tmp);
Update_Status(tmp + " Updation Failed Retry!");
_NewDoc();
}
}
private void Read_MetaData(string _Data)
{
string[] _Meta = null;
char _Char = '';
//int tmp;
Encp.Security encMeta = new Encp.Security();
_Data = encMeta.Decyrpt(ref _Data, ref GlobalPwd);
MessageBox.Show(_Data);
_Meta = _Data.Split(_Char);
Sender = _Meta[0];

Receiver = _Meta[1];
Last_Date_Time = _Meta[2];
Enc_Lang_ = (byte)_Meta[4][0];
Enc_Lang_ = Sel_EncL(Enc_Lang_);
File_ID = _Meta[5];
O_PinNo = _Meta[3];
}
private byte Sel_EncL(byte x)
{
if (x == 55)
x = 7;
else if (x == 49)
x = 1;
else if (x == 51)
x = 3;
else if (x == 54)
x = 6;
else if (x == 56)
x = 8;
return x;
}
private void btnDecrypt_Click(object sender, EventArgs e)
{
string Pno;
int key_Len;
if (txt.Text != "")
{
srvWebApp.SWebService ChkStat = new
ClientApp.srvWebApp.SWebService();

Pno = ChkStat.DownloadKey(File_ID, UserNm);

if (Pno.StartsWith("Error!"))
{
MessageBox.Show(Pno);
Update_Status(Pno);
}
else
{
key_Len = Pno.Length;
Encp.Security DecKey = new Encp.Security();
Pno = DecKey.HDec(ref Pno);
if (Pno.Length * 2 == key_Len)
{
Password = Pno;
Pno = Microsoft.VisualBasic.Interaction.InputBox("Enter the
PinNo", "Pin Number Required", "", 100, 100);
if (Pno != "")
{
//MessageBox.Show(Pno);
if (O_PinNo == Pno)
{
BaseEngine.clsEncDec decDoc = new
BaseEngine.clsEncDec(Enc_Lang_);
txt.Text = decDoc.Decryption(txt.Text, Password);
txtSender.Text = Sender;
txtReceivers.Text = Receiver;
txtDate.Text = Last_Date_Time;
Update_Status("Decryption Process has been done
successfully");
}else

{
MessageBox.Show("Incorrect Pin No try agani!");
Update_Status("Incorrect Pin No try agani!");
}}}{
Update_Status("Error while Downloading the Key");
}
}
}

D. SNAPSHOTS

Figure D.1 Implementation of base Algorithm

Figure D.2 Implementation of Client Application

Figure D.3 Implementation of Server Application

Figure D.4 Implementation of SSL Transaction