Security Architecture & Cryptography Whitepaper
An in-depth technical specification of the zero-knowledge Single Sign-On protocol, SHA-256 certificate ledgers, offline gate HMAC verification, and anti-cheat sandbox isolation.
Unified Single Sign-On (SSO) Protocol
PiTechPedia implements an enterprise-grade token exchange protocol built on OAuth2 + JWT with asymmetric ECDSA P-256 signatures. When a student authenticates on atlas.pitechpedia.com or any partner college portal, an encrypted, HTTP-only, SameSite=Strict cross-subdomain ticket is established across the apex domain .pitechpedia.com.
Payload: {"sub": "usr_94a8e2", "iss": "auth.pitechpedia.com", "roles": ["student"], "coins": 30, "exp": 1793200000}
Signature: ECDSA-SHA256(SecretKey, Base64Payload)
Offline HMAC-SHA256 Gate Access (Pi-Scan)
Event halls, symposium auditoriums, and campus perimeter gates frequently experience network throttling or complete Wi-Fi blackouts. Pi-Scan solves this through ephemeral HMAC-SHA256 QR tokens with rotating salt seeds.
- check_circle Zero Network Dependency: Gate devices carry an encrypted local manifest of authorized student hashes synced before gate opening.
- check_circle Sub-300ms Processing: QR decoding and signature verification occur strictly on-device in under 0.3 seconds.
- check_circle Replay-Attack Protection: Timestamps embedded in each QR payload expire after 45 seconds, preventing forwarded screenshots from passing.
Anti-Cheat Proctored Execution Sandbox (Pi-Exams)
Pi-Exams isolates the student testing environment utilizing a four-layer verification barrier:
1. Full-Screen Lockdown
Enforces Fullscreen API with automatic blur detection, dual-monitor lockout, and clipboard interception.
2. Kernel-Level Keystroke Analysis
Detects automated macro bots, AI copy-paste pasting speed anomalies, and headless browser automation.
3. Sandboxed Code Evaluation
Candidate code runs inside isolated Docker containers with 1-second CPU timeout and restricted network access.
4. Immutable Score Attestation
Test scores are cryptographically stamped into a tamper-proof verification hash verifiable by hiring recruiters.
Data Sovereignty & University Encryption Standard
All data transmitted between colleges, students, and ecosystem nodes is protected under TLS 1.3 with Perfect Forward Secrecy. Backups are encrypted with AES-256-GCM. We adhere strictly to institutional compliance requirements (FERPA, GDPR student protection guidelines) ensuring zero selling or monetization of academic records.