Security & Cryptographic Architecture

The SVKMHM Educational Hostel Management System is engineered with a strict defense-in-depth security model. We recognize that residential student data, parent emergency contacts, and campus movements require rigorous technical safeguards.

Rather than relying on basic perimeter controls, SVKMHM embeds cryptography, zero-trust role segregation, time-synchronized nonces, and automated lifecycle policies into every layer of the application stack.

Database security at SVKMHM operates on the principle that the database server itself should never store sensitive personal details in plaintext.

• Authenticated Galois/Counter Mode (AES-256-GCM): Every sensitive column—including student phone numbers, parent mobile numbers, home addresses, local guardian details, and bank account numbers—is individually encrypted using AES-256-GCM.
• Cryptographic Authentication Tags: GCM mode generates a 128-bit authentication tag alongside each ciphertext. Any database tampering, truncation, or unauthorized alteration causes immediate decryption failure, triggering a security alert.
• Unique Initialization Vectors (IV): Every encryption operation utilizes a cryptographically random 96-bit IV, ensuring that identical plaintexts never produce matching ciphertexts.

Residential roll-call attendance is verified through a high-frequency dynamic token rotation system:

• 4-Second Cryptographic Lifespan: Attendance QR tokens generated on the student portal refresh automatically every 4 seconds.
• HMAC Signature Verification: Each token payload encapsulates the student profile ID, timestamp, rotation epoch, and a secret HMAC signature that is verified cryptographically by the scanner.
• Supersession & Replay Prevention: The instant a new QR token is generated, all previously issued tokens for that student are invalidated. When scanned by an Attendance Officer, the token is permanently consumed, locking the student's status for the evening.
• QR Role Decoupling: The Gate Pass QR code (used for campus entry/exit) is cryptographically segregated from the Attendance QR code. Physical Student ID cards presented at an attendance scanner are automatically intercepted and rejected with an institutional notice.

User access is strictly partitioned across five distinct institutional roles, each with dedicated controllers, middleware, and database boundaries:

To prevent session hijacking and unauthorized terminal takeovers:

• 30-Minute Inactivity Expiry: Sessions automatically terminate after 30 minutes of idle time (gc_maxlifetime = 1800).
• Session ID Regeneration: Session identifiers are regenerated upon every successful login, neutralizing session fixation attacks.
• Security Cookie Hardening: All cookies are issued with HttpOnly, SameSite=Lax, and Secure flags.
• CSRF Token Enforcement: Every state-changing request requires a verified per-session CSRF token.

SVKMHM maintains a comprehensive append-only audit log of critical system interactions:

• Authentication Events: Login successes, MFA challenges, failed attempts, and password reset initiations.
• Gate & Scanner Operations: Gate entry/exit verification, scanned token validations, and attendance confirmations.
• Administrative Modifications: Room transfers, manual approval actions, student profile updates, and fee receipt creations.

All digital documents and student profile photos undergo strict multi-phase sanitization before storage:

• Strict MIME & Magic Byte Validation: Uploaded images are validated for genuine JPEG, PNG, or WebP binary headers.
• Server-Side Image Re-Encoding: Images are re-processed and re-compressed on the server to strip embedded malicious scripts or EXIF metadata.
• Path Traversal Defense: All file storage operations sanitize relative file paths, neutralizing directory traversal attacks (../../).
• Restricted Execution: Storage directories are located outside execution paths with direct script execution strictly disabled.