Access Control Mechanisms for Secure Websites

The research developed an advanced approach toward protecting sensitive information of individuals using a multi-layered access control system in web applications. It integrates traditional authentication and post-login data protection mechanism. It follows a dual-phase security system, first username-password authentication with One-Time Passwords (OTP) for primary login and another PIN system that especially guards some sensitive information inside the account of the user. The architecture is therefore an answer to the crucial need to safeguard different levels of personal data, general account access and highly sensitive information requiring different security thresholds. Our implementation showed that it is able to prevent unnecessary access to sensitive information and maintain smooth user experience on average 8 seconds and 12 seconds in its general features and PIN protection, respectively. It describes how the use of time-based OTPs for the sole purpose of primary authentication along with a separate PIN validation is implemented in accessing the secured personal information. Thus, it is an invaluable input into how hierarchical security measures should be applied within web applications. The results show that protecting sensitive information is significantly improved from systems with uniform security levels to all data types.