\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={A Secure Framework for IoT Smart Home by Resolving Session Hijacking},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2020-01-15 (revised: 15 January 2020)}
\def\TheID{\makeatother }
\def\TheDate{2020-01-15}
\title{A Secure Framework for IoT Smart Home by Resolving Session Hijacking}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Fozilatoon  Humaira}

             \author[2]{Md Sanju  Islam}

             \author[3]{Sanjida Akter  Luva}

             \author[4]{Md Bayazid  Rahman}

             \author[5]{Md Bayazid  Rahman}

             \affil[1]{  Notre Dame University Bangladesh}

\renewcommand\Authands{ and }

\date{\small \em Received: 16 December 2019 Accepted: 31 December 2019 Published: 15 January 2020}

\maketitle


\begin{abstract}
        


IoT is a blessing in the field of information and technology. It is developing and deploying day by day. It is working for our betterment in the section of home, environment, retail, security, factory, industry, agriculture, education, energy, healthcare, and so on. In the Smart Home section, there are a numerous inventions. Vast analysis and working can be possible if needed. We have worked with session hijacking and implement it in our Smart Home Prototype. This paper represents the basic concept of IoT in Smart Home with Security like Session Hijacking.

\end{abstract}


\keywords{IoT, internet of things, smart home, session regeneration, security, session hijacking}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{I. Introduction}]{I. Introduction}\par
nternet of Things is a system of systems that means all the electronic devices are connected in a local area forming a system. Further, this system will connect with each other to build up a bigger system. Basically, IoT is a concept or technology which aims to connect all the devices to the internet and help them communicate with each other using the internet as a medium. This technology is developed for better efficiency and accuracy apart from minimizing human interaction with the device. Some application areas of the Internet of Things are: Home Automation, Healthcare, Agriculture, Transportation, Manufacturing, and Environment. We have worked in the Smart Home part and develop its security.\par
The organization of the paper is as follows: section 2 discusses the related work and motivation. Required tools described in section 3. Proposed Web app and Improved Security schemes are discussed in section 4. Our Experimental results are in section 5. And we have put our Future work in section 6 and in the study we have faced some problems that have limited some scopes and these limitations are also in this chapter. Section 7 concludes our work with the conclusion part. 
\section[{II. Related work and Motivation}]{II. Related work and Motivation}\par
There are a lot of IoT applications that we can see. A famous website Product Hunt lets users share and discover new products which have made a ranking that is displayed below:\par
Author ? ? ? ?: Department of Computer Science and Engineering Notre Dame University Bangladesh, Motijheel, Dhaka, Bangladesh. e-mails: h.fafpa21@gmail.com, sanjuislam30@gmail.com, sanjida.luva@gmail.com, bayazid@ndub.edu.bd Analyzing these we have decided to work in the session hijacking and smart home. We have also gone through some related papers.\par
In paper [b9], a lightweight handshake mechanism is used between the client and server for authentication that produces encrypted payloads. Although they claim the scheme is efficient for replay attack but they cannot determine whether it can prevent other security attacks or not.\par
By reading the [b10], we have got to know this paper proposes an IoT-Based Dual-Mode Smart Home Automation System. The system uses a touch screen interface mode. A mobile app is developed to enable home users to monitor and control their home appliances using mobile.\par
In paper [b8], we have found that A smart home-based on the internet of thing to enable the control and the remote monitoring of home's devices and to allow the user to adapt the system to his desires and needs. This paper presents an approach to implementing a smart home system using the Internet of thing IoT, Web services, and an Android App.\par
By going through [b11], Session-id is encrypted and de-crypted between the server and the client. Here the attacker cannot know the session id as it is already a signed value that needs not to be encrypted. 
\section[{III. Tools}]{III. Tools}\par
A detailed study has been done to find the appropriate hardware and software resources to fulfill the requirements of the smart home.\par
Hardware For our work purpose, we have used Arduino Uno as Micro-controller, ESP8266 as WIFI Module, DHT11 as Temperature and Humidity sensor, LED and Fan. 
\section[{Software}]{Software}\par
Arduino IDE, Xampp. 
\section[{Language}]{Language} 
\section[{PHP, JavaScript}]{PHP, JavaScript}\par
Database MySQL 
\section[{IV. Proposed Approach}]{IV. Proposed Approach}\par
Within the IoT Functional Block, we have worked with devices, application, the security of the smart home, and smart home application. 
\section[{a) Proposed Web app}]{a) Proposed Web app}\par
Our proposed scheme includes an IoT based Smart Home, where different sensors and devices will act as clients, which will be controlled with the help of an application. The application is mainly web-based that will help to monitor and control the smart home. The proposed web-based app will be built with the help of HTML, PHP, and JavaScript. The user interface will be designed with HTML and PHP, and JavaScript will be used for the development of the web application. A database will also be comprised in the proposed scheme to store the data related to smart home and smart home app. The database will consist of two tables -user and weather. The user table will hold the information of the registered users such as User name, email, and password. The password will be stored in the database in an encrypted form with the help of Hashing. The weather table will hold the information about the weather of the smart home. It will store the data about temperature and humidity. The web application at first will have a registration page. A user must be registered to the app by providing the information such as username, email, and password which will be then stored in the database. After completing the registration, the user will automatically be logged into the application.\par
A user must log in to the app to control the appliances of the smart home for which the app will have a login page. When the username and password provided by the user will match with the stored information in the database, then the user can log in to the application. 
\section[{Fig. 3: Login sequence}]{Fig. 3: Login sequence}\par
After logging into the app, the user can monitor the temperature and humidity of the smart home and can control appliances of the smart home. The temperature and humidity will be captured by the DHT sensor and stored in the weather table of the database. Then readall.php file will read the weather information from the database. The user can read all the weatherrelated data by accessing the readall.php file. After that, the index.php file of the proposed web app will get data from readall.php file and display the last current value of temperature, humidity on the app. 
\section[{b) Improved Security of the web app}]{b) Improved Security of the web app}\par
The concept of session id will be used with our app. Session id will keep the login status on record so the user can browse as many passwords-protected pages as he wants without having to login again until he logs out. After a user signs in, a session will be securely created by the server. Then, that session ID will be stored in a session cookie on the user's browser. While the user will remain logged in, the cookie will be sent with every subsequent request. At each appeal, the server will take a look at the session cookie to read the session ID. If it matches the data stored in its memory, it will send a response back to the browser, letting it know everything is okay and ready to go. But Session initiation is a prerequisite to access the app and the other document. If the user is not logged into the app, the server will not provide any session-id, and without the session id the user cannot browse any password protected page and will return to the login page with the request for doing log in.\par
A security attack can take place regarding log in process. If a person who will be not registered to the app, somehow can manage to get the session id, can log in to the app. With this session-id the attacker can send access requests to the server and will get access permission from the server. 
\section[{Fig. 4: Sequence Diagram of Session Hijacking}]{Fig. 4: Sequence Diagram of Session Hijacking}\par
To prevent this attack, session regeneration will be used. With the help of this, the current session will be invalid after logging out from the app and will generate a new session-id with the next login. Once the session becomes invalid, the attacker cannot access any of the information.\par
If the attacker logs into the app with the session id, then he can access the readall.php file to get all the weather data of that smart home. Here the proposed scheme will use an encryption method. All the weather data of the database will be encrypted with AES using only one secret key. As a result, the readall.php file will show the encrypted weather data. Hence the attacker can access the readall.php file, will only get the encrypted data.  
\section[{V. Experimental Result}]{V. Experimental Result}\par
As discussed in our proposed scheme, we have developed a web-based app through which we can monitor the temperature and humidity of our smart home and control other appliances of the home.\par
Without any authentication process, anyone can use the app, which will be vulnerable for the security of the smart home. To enhance the surveillance of the smart home, we have developed an authentication scheme for our web app. In this scheme, a person must register himself to the database user table. For this, there will appear a registration page on the web app where the user must provide a username, email address, and password to sign up.\par
The database is created in MySQL, and a user table in the database has all the information that a user provides to register into the app. For the security purpose the passwords are encrypted with hashing function. The MD5 message-digest algorithm, is used for the hash function. It converts the password to 128-bit hash value and saves it in the database.   Once a user completes the registration process, he can log in to the app with a proper username and id. If the username and password match with the information located in the user table of the database, he can log in to the app successfully. 
\section[{Fig. 13: Session Start}]{Fig. 13: Session Start}\par
If the username and password mismatch with the information saved in the database, then it will show a message saying wrong username/password combination. So to gain access to the app, the user must provide with proper username and password. Otherwise, no one can access the web app.\par
When a user logs into the app successfully with proper username and password, the server will provide with a sessionid. With this session id, the user can access any password-protected page. He does not need to submit the password again and again to browse any file. He can send the request with the session id to browse the file. If the session id is valid, the server will redirect him to the requested page.\par
The session will be valid until the application is logged in. When the user logs out from the application, the session will be invalid. Once the session becomes invalid, the user cannot access any file. To read any document, the user must login the application again. If the user requests to check over any file, it will redirect him to the login page. With the successful login process, the session will start again and permit to access files. If the attacker somehow gets the session id, he can log into the app with that session id. He does not need any proper username and password to log in to the application. With the valid session id, the attacker can successfully login into the application and browse any files, monitor, and control the smart home.\par
We copy the session id after successfully login to the app and use that session id to log in to app from chrome incognito and it successfully logs in to the app without the username and password. We can browse the files after logging into the application.\par
Here to update the security of the web app, we have to prevent this session hijacking. We have used a function called session regenerate. With this function, the different sessions will regenerate with every login process. Without this function, the same session id is provided for every login process. So if the attacker once gets the session id, he can easily log into the app with the id as many times as he wants. But this function provides different session-id with each login request. So the attacker cannot use the same session id to log into the application. Now, if the real user logs out from the application, then the session will be invalid. As a result, the attacker can no longer use the application with that old session id. So whenever the attacker sends a request to browse any file with that old session id, the server will redirect him to the login page.\par
We logged in to the application using session-id from chrome incognito. Then we logged out from the application from our browser and tried to browse the file from incognito. But it redirected us to the login page as the session became invalid.\par
We have used the DHT11 sensor to read the temperature and humidity amount. We have used led to turn on and off the light. The DHT11 sensor and LEDs are connected with the Arduino Uno. The DHT11 sensor reads the temperature and humidity with 3000 ms delay and inserts the values to the database weather table.\par
The readall.php file reads the temperature and humidity values from the database. We can see all the weather values in this file. The index.php file reads only the last value and shows it on the web application. So the temperature and humidity that are shown on the homepage of the application are the ending value of the database that is stored by the DHT11 sensor. Now when the attacker logs in to the app with the session id, he can browse the files till the session is valid. To protect the weather data from the attacker, we have encrypted the weather value in the readall.php file using the AES algorithm. As a result, the attacker can only see the encrypted values.\par
Finally, on the home page of our web application, there are temperature and humidity values, date, and log out option on the front side. Then we can choose different rooms of our smart home to control and monitor the devices.\par
We prefer session-id for improving the security of our web application than JWT (Java Web Token). JWT consists of three parts where session-id consists of the only session key. So if we store session id in a cookie the total size is Six bytes. If we store the id in JWT the aggregate content is 304 byte. As a result, the size of the token would become problematic because along with each request to the server we must include the JWT \hyperref[b0]{[1]} A session is also more reliable because the only thing stored on the client is a session key. The actual data remains on the server, whereas in the term of JWT, the user information is stored in the payload.\par
Session id does not need to be encrypted as It is already a signed value. But JWT needs to be encrypted as it carries user information \hyperref[b1]{[2]}.\par
In \hyperref[b2]{[3]} paper, the session-id is encrypted. But as session-id already a signed value so encrypted session id cannot play a meaningful role where session regeneration can be a goof reliable. Insecure session. 
\section[{Our Proposed Scheme}]{Our Proposed Scheme}\par
Attacker cannot access the user creden-tials and session hi-jacking is prevented.\par
Maintenance cost and the unnecessary ports can not be blocked   
\section[{VI. Future Work and Limitations}]{VI. Future Work and Limitations}\par
In doing this thesis study, we have found some limitations. We also have bounded time, so we have to pause our work for some time and will have to do in the near future with more research and study. a) Future Work 
\section[{Use Encrypted Communication}]{Use Encrypted Communication}\par
We will try to use a TSL certificate to make our communi-cation encrypted and more secure. 
\section[{Two-factor authentication}]{Two-factor authentication}\par
We will try to use email and SMS service in Twofactor authentication regard. 
\section[{Android Application}]{Android Application}\par
Discussed earlier, we have developed a webbased app for our smart home. We will try our best to add more features in this work, such as to develop a mobile application to control the smart home.\par
Till now, we have developed the control of appliances only for the living room of our smart home. In the future, we will complete the whole smart home. 
\section[{b) Limitations}]{b) Limitations} 
\section[{Maintenance Cost of Server}]{Maintenance Cost of Server}\par
We have used the server as an ordinary user. But some days later, we were unable to work on that as there needed a premium account for further work. That's why we were unable to provide more security features for our smart home. 
\section[{Database encryption}]{Database encryption}\par
As at last, we have to use the server an usual user, we cannot use the encryption function in the database. 
\section[{Block unnecessary ports}]{Block unnecessary ports}\par
As we were unable to use the proper database so we cannot block unnecessary ports. 
\section[{VII. Conclusion}]{VII. Conclusion}\par
The rising technology Internet of Things is changing lives by connecting limitless devices. In the near future, IoT has a remarkable effect. There will be a net of IoT connecting worldwide devices. It will bring the nations closer. It will help to connect people and get information anytime and anywhere in the world. Home is one of the most important things for human beings. It should be confirmed with security at all times. The development of IoT has penetrated various areas of life, one of the applications is the smart home system. A Smart home is built to provide convenience and comfort to residents in the management of their homes. Also, this system can also be a solution in an energy-saving effort at home. Some essential things that need to be designed in a smart home system are communication protocols, network security, as well as databases. In addition, the database in My SQL can also be managed perfectly and always in sync with every process that is being run. This paper puts the light on a smart home with security regarding IoT. b We are exploring Applications, and here we also are working for additional insights.\begin{figure}[htbp]
\noindent\textbf{12}\includegraphics[]{image-2.png}
\caption{\label{fig_0}Fig. 1 :Fig. 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{5}\includegraphics[]{image-3.png}
\caption{\label{fig_1}Fig. 5 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{6}\includegraphics[]{image-4.png}
\caption{\label{fig_2}Fig. 6 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{7910}\includegraphics[]{image-5.png}
\caption{\label{fig_3}Fig. 7 :Fig. 9 :Fig. 10 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{11}\includegraphics[]{image-6.png}
\caption{\label{fig_4}Fig. 11 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{14}\includegraphics[]{image-7.png}
\caption{\label{fig_5}Fig. 14 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{17}\includegraphics[]{image-8.png}
\caption{\label{fig_6}Fig. 17 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-9.png}
\caption{\label{figure9}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{P{0.466023166023166\textwidth}P{0.0886100386100386\textwidth}P{0.17065637065637065\textwidth}P{0.12471042471042472\textwidth}}
Applications\tabcellsep Popularity\tabcellsep Twitter search\tabcellsep Google search\\
Smart Home\tabcellsep 100\tabcellsep 3.3k\tabcellsep 61k\\
Wearables\tabcellsep 63\tabcellsep 2k\tabcellsep 33k\\
Smart City\tabcellsep 34\tabcellsep 0.5k\tabcellsep 41k\\
Smart Grid\tabcellsep 28\tabcellsep 01.k\tabcellsep 41k\\
Industrial Intranet\tabcellsep 25\tabcellsep 1.7k\tabcellsep 10k\\
Connected Car\tabcellsep 19\tabcellsep 1.2k\tabcellsep 5k\\
Connected Health\tabcellsep 6\tabcellsep 0.5k\tabcellsep 2k\\
Small Retail\tabcellsep 2\tabcellsep 0.2k\tabcellsep 1k\\
Smart Supply Chain\tabcellsep 2\tabcellsep 0.2k\tabcellsep 0k\\
Smart Farming\tabcellsep 1\tabcellsep 0.0K\tabcellsep 1k\end{longtable} \par
 
\caption{\label{tab_0}Table 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2} \par 
\begin{longtable}{P{0.053968253968253964\textwidth}P{0.7060846560846561\textwidth}P{0.08994708994708994\textwidth}}
\tabcellsep \multicolumn{2}{l}{of Web Application}\\
\tabcellsep Vulnerabilities [3]\tabcellsep \\
S.No.\tabcellsep Vulnerability\tabcellsep Percentage\\
1\tabcellsep SQL Injection\tabcellsep 30\\
2\tabcellsep Session Hijacking\tabcellsep 28\\
3\tabcellsep Cross-site scripting\tabcellsep 18\\
4\tabcellsep Distributed DoS attack\tabcellsep 8\\
5\tabcellsep Phishing attack\tabcellsep 8\\
6\tabcellsep Cloning attack\tabcellsep 4\\
7\tabcellsep Others\tabcellsep 4\end{longtable} \par
 
\caption{\label{tab_1}Table 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{III} \par 
\begin{longtable}{P{0.4067267683772538\textwidth}P{0.3076976421636616\textwidth}P{0.1355755894590846\textwidth}}
Approach\tabcellsep Description\tabcellsep Tools\\
A Prevention Model\tabcellsep \tabcellsep \\
for Session Hijack At-tacks in Wireless Net-works Using Strong and Encrypted Ses-sion\tabcellsep Session-id is Encrypted and decrypted between the server and the client\tabcellsep AES, RSA, SKS algo-rithm\\
ID [3]\tabcellsep \tabcellsep \\
JSON Web Token\tabcellsep \tabcellsep \\
(JWT) based client authentication in Message Queuing Telemetry Transport\tabcellsep JSON Web Token is Exchanged between broker and client\tabcellsep TLS, MQTT protocol\\
(MQTT) [4]\tabcellsep \tabcellsep \\
Design of Database And Secure\tabcellsep The communication is\tabcellsep \\
Communication Protocols for\tabcellsep encrypted with both AES and\tabcellsep AES,RSA algorithm,\\
Internet of Things based Smart\tabcellsep RSA. The database is used to\tabcellsep MYSQL.\\
Home System Trio Adorno [5]\tabcellsep store the data.\tabcellsep \\
Our Proposed Scheme\tabcellsep Session fixation and encrypted data.\tabcellsep AES algorithm, PHP, MD5 hash function, MYSQL\end{longtable} \par
 
\caption{\label{tab_2}Table III :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{IV} \par 
\begin{longtable}{P{0.1345156889495225\textwidth}P{0.46732605729877214\textwidth}P{0.11364256480218282\textwidth}P{0.1345156889495225\textwidth}}
\tabcellsep \multicolumn{3}{l}{A Secure Framework for IoT Smart Home by Resolving Session Hijacking}\\
Year 2 020\tabcellsep \tabcellsep \tabcellsep \\
16\tabcellsep \tabcellsep \tabcellsep \\
Volume XX Issue II Version I\tabcellsep \tabcellsep \tabcellsep \\
( ) G\tabcellsep \tabcellsep \tabcellsep \\
Global Journal of Computer Science and Technology\tabcellsep Approach A Prevention Model for Session Hijack At-tacks in Wireless Net-works Using Strong and Encrypted Ses-sion ID [3] JSON Web Token (JWT) based client authentication in Message Queuing Telemetry Transport (MQTT) [4] Design of Database based Smart Home and Secure Communication Protocols for Internet of Things\tabcellsep Advantage The attacker cannot know the session id Encrypted communication Encrypted Communication.\tabcellsep Disadvantage Session Id is already a signed value which needs not to be en-crypted User information is stored in JWT\\
\tabcellsep System Trio Adiono [5]\tabcellsep \tabcellsep \\
© 2020 Global Journals\tabcellsep \tabcellsep \tabcellsep \end{longtable} \par
 
\caption{\label{tab_3}Table IV :}\end{figure}
 			\footnote{© 2020 Global Journals} 			\footnote{© 2020 Global JournalsA Secure Framework for IoT Smart Home by Resolving Session Hijacking} 		 		\backmatter   			 
\subsection[{Acknowledgment}]{Acknowledgment}\par
The fulfillment of this undertaking could not have been possible without the participation and assistance of so many people whose names may not all be enumerated. Their contri-butions are sincerely appreciated and gratefully acknowledged. We are thankful to our supervisor Md Bayazid Rahman. We are also grateful to A.H.M Saiful Islam (Chairman, Department of Computer Science and Engineering), Dr. Fernaz Narin Nur and the respected faculty of Computer Science and Engineering, Notre Dame University Bangladesh for their guidance in our work.\par
To all relatives, friends, and others who in one way or another shared their support, either morally, financially and physically, thank you.\par
Above all, to the Great Almighty, the author of knowledge and wisdom for giving countess blessings. 			  			  				\begin{bibitemlist}{1}
\bibitem[Jan and Ahmad ()]{b8}\label{b8} 	 		‘A payload-based mutual authentication scheme for Internet of Things’.  		 			Mian Jan 		,  		 			Ahmad 		.  	 	 		\textit{Future Generation Computer Systems}  		2019. 92 p. .  	 
\bibitem[Manivannan and Sathiyamoorthy ()]{b2}\label{b2} 	 		‘A prevention model for session hijack attacks in wireless networks using strong and encrypted session ID’.  		 			S S Manivannan 		,  		 			E Sathiyamoorthy 		.  	 	 		\textit{cybernetics and information technologies}  		2014. 14 p. .  	 
\bibitem[Manivannan and Sathiyamoorthy ()]{b7}\label{b7} 	 		‘A prevention model for session hijack attacks in wireless networks using strong and encrypted session ID’.  		 			S S Manivannan 		,  		 			E Sathiyamoorthy 		.  	 	 		\textit{cybernetics and information technologies}  		2014. 14 p. .  	 
\bibitem[Shingala ()]{b0}\label{b0} 	 		\textit{An alternative to the Public Key Infrastructure for the Internet of Things},  		 			Krishna Shingala 		.  		2019. NTNU.  	 	 (MS thesis) 
\bibitem[Solapurkar ()]{b1}\label{b1} 	 		‘Building secure healthcare services using OAuth and JSON web token in IOT cloud scenario’.  		 			Prajakta Solapurkar 		.  	 	 		\textit{2nd International Conference on Contemporary Computing and Informatics (IC3I)},  				2016. 2016. IEEE.  	 
\bibitem[Adiono ()]{b4}\label{b4} 	 		\textit{Design of database and secure communication protocols for internet-of-thingsbased smart home system},  		 			Trio Adiono 		.  		2017.  	 
\bibitem[Karimi and Krit ()]{b10}\label{b10} 	 		\textit{Internet of Thing for Smart Home System Using Web Services and Android Application},  		 			Khaoula Karimi 		,  		 			Salahddine Krit 		.  		2019. Singapore: Springer. p. .  	 	 (Smart Network Inspired Paradigm and Approaches in IoT Applications) 
\bibitem[Hamdan ()]{b9}\label{b9} 	 		‘IoT-based interactive dual mode smart home automation’.  		 			Omar Hamdan 		.  	 	 		\textit{IEEE International Conference on Consumer Elec-tronics (ICCE)},  				2019. 2019. IEEE.  	 
\bibitem[Shingala ()]{b3}\label{b3} 	 		\textit{JSON Web Token (JWT) based client authentication in Message Queuing Telemetry Transport (MQTT)},  		 			Krishna Shingala 		.  		 arXiv:1903.02895.  		2019.  	 	 (arXiv preprint) 
\bibitem[Woods ()]{b5}\label{b5} 	 		\textit{School of Computing Information Engineering},  		 			Derek Woods 		.  		2018.  	 
\bibitem[Kumar et al. ()]{b6}\label{b6} 	 		\textit{SECURITY ISSUES AND APPLI-CATIONS OF INTERNET OF THINGS},  		 			Kumar 		,  		 			Farooq 		,  		 			Sunar 		.  		2019. 6 p. .  	 
\end{bibitemlist}
 			 		 	 
\end{document}
